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ABSTRACT 

This thesis examines the increase in reliability 
of a thermal power control system by using redundant 
temperature and pressure instrumentation. This 
improvement in reliability can be accomplished by 
applying various multiplexing techniques to the noisy 
signals from a set of redundant instrument channels. 
Multiplexing techniques such as averaging, mediating, 
and voting based on weight factors will be examined 
in detail along with probabilistic analysis and 
experimental verifications. The effect of multiplexing 
on noise reduction will also be discussed. And finally, 
the area of instrument error distribution within a 
real-time system is briefly introduced to provide basis 
for future work. 
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PREFACE 

An often utilized technique to increase the reliability- 
in any control system is the use of redundancy. The art of 
redundancy, however, comes in many variations. It could 
be redundancy in the software, like a back-up computer 
program package in an interplanetary spacecraft; or it could 
be redundancy in the hardware, like a set of triply redun- 
dant signal processing channels, as is the case in this thesis. 

A system that uses redundancy to increase its overall 
reliability is sometimes referred to as "a fault-tolerant 
system". Fault-tolerance is the unique attribute of a control 
system which makes it possible for the system to continue with 
its program-specified behavior as a logic machine after the 
occurrence of faults. 

One area of engineering that the application of redundancy 
has been mostly neglected is the redundancy of primary instru- 
mentation in a thermal power system. Without redundancy, 
if the one and only instrument fails, the entire control system 
will more than likely malfunction. One must recognize the 
tremendous amount of revenue at stake when a power plant is 
shutdown due to a simple instrument failure. 

In this thesis the author will first present an overview 
of the principle of fault-tolerance, its incentives and 
methods of implementation (chapter 1). In chapter 2 a study 
will be conducted on the errors and uncertainties of 
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instrument measurements obtained through temperature and 
pressure instrumentation. The area of probabilistic logics 
as applied in instrumentation redundancy will be discussed 
in chapter 3. Next, the author will demonstrate how the 
techniques of averaging and voting would significantly 
improve the quality of the signals and increase the reliabi- 
lity of such redundant instrumentation system (chapter 4). 

In chapter 5 a case study of some of the unique and highly 
reliable control systems at the Deer Island Sewage Treatment 
Plant will be presented. And finally in chapter 6, the 
method of using constitutive and conservation lav/s to 
minimize measurement errors will be briefly examined. 
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CONCLUSIONS 

Using the techniques of averaging, mediating, and voting, 
there is little doubt that the overall reliability has been 
greatly increased for a control system using redundant 
instrumentation. In order to maximize the full advantages of 
fault-tolerance, however, one must devote complete attention 
to the implementation of redundant hardware at the outset of 
system design. 

It can be concluded that multiplexing techniques such 
as averaging and voting can indeed increase the reliability 
of any redundant instrumentation system, as shown by pro- 
babilistic analysis and experimental verifications. Moreover, 
the implementation of such techniques is easily realizable, 
as the author has illustrated with an example. Furthermore, 
due to the high frequency spectral content of a voter output, 
the technique of multiplexing can actually be utilized to 
simplify the task of noise reduction. 

And finally as indicated in chapter 6, instrument error 
distribution within a real-time system is indeed an important 
aspect of redundant instrumentation. Much more work needs to 
be done in this area. 
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CHAPTER I 

INTRODUCTION TO ENGINEERING OF RELIABILITY 
A. Introduction 

If for example one simply installs a redundant 
instrument at the temperature sensing point in a thermal 
power plant, there is no question that the reliability of 
the temperature measurement has been increased. This is 
due to the simple fact that if one instrument malfunctions, 
a second instrument is still available to measure the para- 
meter. However, if one ponders for a moment, he begins to 
wonder if he could improve the quality of the measurements at 
all times, even when there is no instrumentation malfunction 
at all. This question is especially valid if one recognizes 
the fact that temperature sensing devices come in many differ- 
ent types, e.g. RTDs, thermistors, and thermocouples; all of 
these instruments have their own inherent errors and uncertain- 
ties. Could one improve the quality of the measurements so 
that the output signal is always equal to the best of the 
signals from the different primary sensors? The answer is, 
"Yes, a fault-tolerant system can do just that". The reader 
will see why in the pages to follow. 

Fault-tolerance is the architectural attribute of a di- 
gital system that keeps the logic machine doing its specified 

tasks when its host, the physical system, suffers various 

( 1 ) 

kinds of failure of its components. 



A fault-tolerant 
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system using redundant instrumentation does more than that; 
even during normal operations, the logic circuitry is able to 
select the best possible signal using various multiplexing 
techniques. 

A fault-tolerant control system using redundant instrument- 
ation can be illustrated by the flowchart in Fig. 1.1. 




Multiple Signals 
from 

Redundant Instruments 



Process of Selecting 
the Most 
Reliable Signal 



Fig. 1.1 A Control System Flowchart 

Considerable research has been performed in the area of the 
center block, the complex process of assuring that a most 
reliable signal is always available. On the other hand, very 
little work has been done to combine the advantages of 
redundant instrumentation with the highly reliable techniques 
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of multiplexing. In fact, since Dean Karnopp and Erich 

Bender first reported their experimental findings for an analog 

( 2 ) 

system in 1966, hardly any other reports have surfaced. 

The entire chapter 2 has been devoted to the errors and 
uncertainties of primary instrumentation, so no further mention 
of this subject matter will be made here. Instead, the rest 
of this chapter will be used to introduce to the reader the 
concept of fault-tolerance, a term many engineers have an 
idea of what the final output is, but barely have any notion 
of the manner in which the system performs its function. 
Actually, the term "fault-tolerance" has only been used in 
connection with digital systems for the last 5 to 10 years. 
However, the concept of fault-tolerance, or more explicitly, 
the term "redundancy", has been in the standard vocabulary 
of most design engineers since the 1960's. 

The logic circuitry mentioned in the preceding paragraphs 
could be basically made up of simple passive elements like 
AND or OR gates. They could be logic circuits that would 
select the upper or lower value from a set of signals; or the 
circuit could simply select the median from the same set of 
signals. In any event, when one instrument does fail, the 
resultant reading can be either high or low, or none at all, 
but the logic circuitry can take care of that by either 
masking the physical fault from being transmitted further 
downstream, or in some pre-programmed fashion, acts to continue 
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to provide a reasonable output, although somewhat degraded. 
Chapter 4 will discuss the actual multiplexing techniques in 
detail . 

Some electrical engineers share the viewpoint that the 
presence of fault-tolerance features does not add any perform- 
ance advantages during normal (fault-free) operation. More- 
over, they state that fault-tolerance requires additional hard' 
• ware that is redundant during normal operation and would be 
entirely superfluous in a completely fault-free logic machine. 

The author wishes to point out that in a fault-tolerant 
control system that uses redundant instrumentation, the fault- 
tolerance feature actually improves the overall quality of the 
various signals and improves the reliability of the entire 
system even during normal, fault-free operation. 

B. Reasons for Fault-tolerance 

What are some of the incentives for implementing 
fault-tolerance into a control system? The objective of 
minimizing downtime was mentioned earlier, but there are 
other advantages that have not been mentioned. 

In a thermal power system, if there is only one RTD at a 
critical temperature sensing point, or perhaps just one diaph- 
ragm at the pressure sensing point, then if the instrument 
malfunctions, the usual solution to the problem is a manually 
controlled maintenance action that results in the removal 
or repair of the cause of the fault. The system is then 



/ 
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restarted to run until the next fault strikes. The purpose 
of fault-tolerance is to offer an alternate solution to the 
fault problem in which the detection of faults and the 
recovery to normal operation are carried out as internal 
functions of the system itself. In this regard, fault- 
tolerance can be considered as the survival attribute of the 
logic machine because its function is to return the system 
from error states back to certain specified behavior. 

Without fault-tolerance, a typical malfunction or 
failure usually occurs in the following sequence: The event 

begins with the observation of erratic behavior and a call 
to the maintenance expert and ends with the resumption of 
normal operation N hours later, with N usually found 
somewhere in the range of 0.1 ^ N ^10. If fault-tolerance 
is now incorporated into the control system, human particip- 
ation in recovery is eliminated, and N can be lowered to the 
range of 10 -9 to 10 - ® hour.^^ . 

Historically, fault-avoidance has been used as the 
alternative to fault-tolerance. Unlike fault-tolerance, 
fault-avoidance requires the physical components and their 
assembly techniques to be as nearly perfect (fault-free) 
as possible. In addition, shielding must be installed to 
keep out all forms of external interference. The Apollo 
space program was an excellent example of fault-avoidance. 
Every single component was made to perfection; and the 
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result, as the reader knows, was a flawless space flight in 
every launch. 

As one might expect, fault -avoidance has some drawbacks, 

( 1 ) 

and they are by no means minor. First, not surprisingly 

to anyone, is that it is very expensive. The cost of obtain- 
ing nearly-perfect components in an instrument rises very 
rapidly after failure rates have been reduced to threshold 
values that are characteristic of the physical parameters and 
manufacturing technology of the components. Second, since 
the system will cease proper operation with the first failure 
or malfunction, manual -maintenance personnel must stand by 
continuously with appropriate fault-location and fault-removal 
tools and methods. This requirement represents a major budget 
item for the life-cycle cost of the system. 

The acquisition cost of a fault-tolerant system is higher 
than that of a fault-avoidance system. This additional cost 
is due to the extra effort required to introduce fault- 
tolerance during system design stage and by the cost of redun- 
dant hardware and software that implement fault detection and 
recovery. 

However, the high initial cost could be more than comp- 
ensated for by the lower life-cycle cost. The reduction in 
life-cycle cost is a result of the following reasons. First 
of all, lower cost components can now be used because higher 
failure rates can be accepted for individual components with- 
out degrading system reliability. Secondly, a sharp decrease 
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in downtime will lead to a considerable lower life-cycle cost 
of system operation. And finally, scheduled off-line 
replacement of rejected parts should cost much less than pro- 
viding a cre\\r of continuously ready maintenance experts. 

Without redundancy and fault-tolerance, an unpredic table 
shutdown in a power generation and distribution plant may 
represent a tremendous loss in revenue. Another example with 
the same result is the electronic fund transfers, or the 
telephone switching systems. Besides cost saving, however, 
there are other features of a fault- tolerant system that make 
it highly desirable. Human lives could be endangered if a 
failure occurs in some applications. Some of the examples are 
air traffic control, automatic control of a submarine in a 
diving maneuver, control of nuclear power plants and defense 
systems, and patient monitoring and life support systems in 
highly automated hospitals. 

Still, a third group of control systems that would 
benefit immensely from fault-tolerance consists of systems in 
environments that do not allow access for manual maintenance, 
such as satellite in earth orbit; nuclear reactor instrument- 
ation in a highly radioactive enclosure; unmanned underwater 
stations; and environment-monitoring stations in remote and 
hard-to-reach locations. 

And finally, there is a strong psychological incentive 
for implementing fault- tolerance in any control system. 
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When an operator knows that the failure of a system can 
jeopardize a person's safety or economic well-being, or 
possibly the very first component failure will be fatal to 
the uninterrupted operation of the entire machine, the 
knowledge that fault-tolerance is being used is more than 
likely to considerably reduce his anxiety. 

The author wishes to clarify one point at this time. 

There are distinct differences between primary sensor reliabi- 
lity and computer (logic circuitry) reliability. Primary sen- 
sor reliability deals with the reliability of the instruments 
themselves. Obviously, each instrument has its own failure 
rate; some are more prone to failure than others. In addition, 
each instrument has its own range of uncertainties and errors, 
inherent to any particular type of sensor. On the other hand, 
logic circuitry reliability deals with the failure rates of 
actual circuit elements. The circuit elements, almost exclu- 
sively, are passive components like diodes, resistors, and 
OR gates. As compared to the instruments, these passive 
elements are highly reliable, at least partly due to their 
well-controlled environments both in manufacture and in use. 
More discussion on this subject can be found in chapter 4. 

C . Implementation of Fault-tolerance 

So far in this chapter, the discussion has been 
almost exclusively devoted to the following two areas: 

(1) The interaction between the logic circuitry and the 
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physical instrumentation system, and (2) the incentives 
for implementing fault-tolerance. It is now time to 
describe the common methodology for actual implementation. 

Typically the control system is invariably designed 
for perfect components, assuming fault-free conditions. 

Then, fault-tolerance is introduced. This sequence implies 
additional provisions must be made to add more hardware and 
software elements. These redundant instruments and circuit 
elements will serve to provide the fault-handling algorithms 
and the spare parts needed for recovery. 

Fault- tolerance can be introduced into a control system 
through a systematic sequence of design activities like the 
following: 

(1) Reliability Requirements Reliability require- 

ments must be specified; in other words, a set of performance 
specifications must be defined. 

Fault-tolerance, in this case, is limited to the tole- 
rance of physical faults in each channel. A physical fault 
is an out-of-specification or otherwise undersirable change 
in the values of one or more primary parameters in the system. 
It is caused by a physical failure or degradation that affects 
a primary sensor and may make either a permanent or temporary 
change in the sensed values of the corresponding physical 
variable . 

Permanent physical faults are usually caused by irrever- 
sible changes in components, such as broken RTDs, open 
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connections, ruptured bellows, "bridging" between two leads, 
etc. Temporary faults, on the other hand, are generally 
results of external interferences of relatively short duration, 
typically in power supplies or in signal transmission. These 
interferences change the present values of certain measurements, 
but do not cause irreversible damages to the components. 

After a quantitative reliability requirement has been 
established, the number of redundant channels needed can be 
determined. Each redundant primary instrument with its asso- 
ciated branch of the logic circuitry constitutes a redundant 
channel. From experimental results and other evidence, it 
appears likejLy that the triply redundant system is the optimal 
choice. 

(2) Fault-Detection Algorithms The detection function 

is the starting point of most fault-tolerant implementations. 
This function usually leads to the addition of new components. 
The choice of fault-detection techniques is governed by the 
reliability specification, making certain that all relevant 
fault classes are detectable, and that the probability of 
timely detection is adequate with respect to the reliability 
goals. Both hardware and software techniques are applicable 
here . 

The various methods for fault detection can be summarized 
as follow: 

(a) Initial testing, which takes place prior to 
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normal use and serves to identify faulty instrument 

components containing imperfections introduced during 

( 3 ) 

the manufacturing or assembly process. 

(b) Concurrent (on-line) detection, which the 
author considers as the most important method because 
after all, the underlying advantage of any automatic 
control system is its self-checking feature. It is 
implemented by means of special hardware or software 
that operates concurrently with the regular programs 
of the system. Concurrent detection is important 
because it allows recovery to be initiated before fault- 
caused errors can cause extensive disruption of programs 
or damage to the data. Hardware methods for concurrent 
detection have been used for quite some time, especially 
in the computer and aerospace industries. These methods 
include error-detection codes (chapter 5) , duplication 
and comparison, disagreement detectors with voters 
(chapters 3 & 4) , and plant status and completion signals 
(chapter 5) . 

(c) Scheduled (off-line) detection, which takes 
place when normal operation is temporarily interrupted. 
This method is quite similar to the initial testing 
except that now the testing is executed by the system 



(d) Redundancy testing, which serves to verify that 






- 25 - 

the various forms of protective redundancy are themselves 

fault-free, and takes place either concurrently or at 

/p \ 

scheduled intervals. ' 

(3) System Recovery Algorithms The recovery algorithm 

comprises all actions that are initiated by the arrival of a 
fault signal during normal operation and are normally completed 
by the resumption of normal operation (more than likely in a 
degraded mode), by a deliberate shutdown of the system, or by 
system failure. 

The most fundamental difference between various recovery 
algorithms is whether interaction with a human maintenance 
operator is or is not required as part of the recovery algorithm. 
Recovery algorithms that do not require human decision making 
are automatic; all other algorithms are manually controlled, 
although they may contain extensive programmed sequences. 

In the computer and aerospace industries, most recovery 
algorithms are fully automatic and require no human interven- 
tion. When a certain processor fails, full recovery simply 
involves with the replacement of the faulty processor with a 
spare. However, in the thermal power industry, in the opinion 
of the author, human interaction must play an important role 
in the recovery process, at least in the foreseeable future. 

After recovery has been completed, the system can have 
the following three status: full recovery, degraded recovery, 



and safe shutdown. 
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Full recovery means the return of the system to a set of 
conditions that existed before the fault occurred. In the 
case of a thermal power plant, this procedure usually begins 
with a status light on the monitoring panel identifying one 
or more malfunctions have occurred; plant is operating in a 
degraded mode, and it is now up to the human maintenance 
operator to pinpoint the malfunctions and replace the damaged 
parts. Recovery is concluded when damaged parts have been 
replaced by spares. 

Degraded recovery means that the system is still operating, 
but at a reduced capacity. In a triply redundant instrument- 
ation system, an example of a degraded recovery is that two 
channels could malfunction simultaneously, while the third 
channel is still operating perfectly. The result is a piece 
of data that is not totally correct, but still within an 
acceptable range. The system will remain in this mode until 
faulty instrument or component is replaced. 

Safe shutdown is the limiting case of degraded recovery. 

It is carried out only when the remaining computing capacity 
(if any) is below the minimum acceptable threshold. The 
objectives of shutting down a power plant are two-folded: 

(1) to prevent damage to remaining plant components; and 

(2) to stop interaction with other plant system in a delib- 
erate and orderly manner. 

A special case of hardware-controlled recovery is known 
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as recovery by fault masking. In such systems, faults are 
masked by redundant hardware, and thus remain totally in- 
visible to the software further downstream. The masking 
function employs redundancy to assure that the effect of 
a fault is completely contained within a system module. ’ J 
As long as the redundancy is not exhausted, the fault is 
concealed within the module and no symptoms whatsoever appear 
on its outputs. It is also known as a static redundancy 
because if viewed from the outside, separate detection and 
recovery functions are not identifiable. 

basking is usually accomplished by hardware redundancy, 
i.e. by the replication of hardware elements. The redundant 
elements are assumed to be permanently connected, and to 
fail statistically independently. They have the same failure 
rate and are instantaneously available to perform the masking 
of a failure with unity probability of success. One major 
drawback of static redundancy is that it must be introduced 
at the outset of the design phase. Total devotion must be 
given to fault-tolerance by the design engineers throughout 
the early stage. It is for this reason, as mentioned 
earlier, that the initial cost of a control system featuring 
fault-tolerance is considerably higher than that without 



the same feature 
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D . The Author's Position on Type of Signals being Processed 
This is not a thesis on signal processing, however, 
the principle of multiplexing as applied here deals with the 
processing of signals from various redundant instrumentation. 
Therefore, the author feels that it is appropriate to briefly 
comment on the type of signals being considered here. 

All signals considered in this thesis are digital 16-bit 
parallel words. The 16-bit capacity includes a sign bit and 
an address bit. Moreover, these parallel words are results 
of distributed computing; in other words, the analog-to-digital 
conversion device is powered from an independent power source. 

1 . Why Digital ? 

Digital technology has indeed revolutionized 
the world of instrumentation. Reductions in cost of 
digital integrated circuits and the increase of chip 
complexity are rapidly making feasible the manufacturing 
of digital equipment at a small fraction of the cost for 
their analog counterparts. As a result, it is consider- 
ably easier and less expensive to find a digital system 
to suit one's need as compared to finding an analog 
system that performs the same function. 

Digital systems often capitalize on having a compat- 
ible data base. This is exemplified by a large and 
complex process-control system in which temperatures, 
pressures, and flow rates are all converted into numbers. 
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Ho matter what input is considered, its value ends up in 
the system as a number. In this form, it can be easily 
added, multiplied, integrated, or otherwise processed. 

2. Parallel Conversion 

The best feature of this conversion approach 
is that conversion occurs in parallel, with speed limited 
only by the switching time of the comparators and gates. 
As the input changes, the output code changes. Therefore 
this is indeed the fastest approach to conversion. 

Only a few years ago, A/D conversion was done 
strictly in a serial format, bit by bit. Parallel conver 
sion was not commonly practiced at the time because the 
number of elements needed in a parallel conversion 
increases geometrically with resolution. However, with 
the advent of LSI and VLSI technologies, it is now 

possible to have high resolution and fast speed at the 

. . (9) 

same time . 

3. Distributed Computing 

Distributed computing simply means that the 
A/D conversion and related processing i-ri.ll be done right 
at the signal source ;ri.th an independent power supply. 
This technique, when utilized in a redundant instrument- 
ation system, accomplishes two objectives: first, it 

increases system reliability because a power failure 
will only affect that particular channel; and secondly, 
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by transmitting digital data back to the data center, 
a considerable immunity to line-frequency (50-60-400 HZ) 
pickup and ground-loop interference is achieved. 

The author does not intend to cover the subject of 
A/D conversion in any great detail here; if the reader 
is interested, however, reference (9) provides excellent 
further readings in this area. 

From the general introduction in the preceding paragraphs, 
it is hoped that the reader has gained some knowledge of how 
a fault-tolerant system performs and why its implementation 
is important to a thermal power plant. In the next chapter, 
various kinds of typical power plant instruments, e.g. temp- 
erature and pressure sensors, will be described, along with 
the uncertainties and errors peculiar to each type of instru- 



ment. 



31 



CHAPTER II 

INSTRUMENTATION ERRORS AND UNCERTAINTIES 
A. Introduction 

If an instrument does not seem to have malfunct- 
ioned, then why should one worry about errors and uncer- 
tainties? Likewise, if an instrument appears to be as good 
as the day it came off the production line, why should the 
measurements not be all accurate? 

Of course, when an instrument becomes faulty as a result 
of an open connection, a mechanical failure, or a bridging 
of two adjacent leads, to name only a few examples, the 
measurement may become totally erroneous wi th a reading 
several magnitudes different from a normal reading. In this 
case, the instrument would simply have to be replaced at the 
first opportunity. 

Thus, as one can see, an instrument can malfunction at 
any time, depending on its own failure rate; but in addition, 
even when it is operating under normal conditions, its 
reading can still be out-of-specifications simply due to 
inherent errors and uncertainties. The reader must realize, 
however, that each sensing device possesses unique charact- 
eristics that make it especially desirable in a particular 
application. 

In this chapter, temperature and pressure sensors, the 
two most important and commonly found instruments in a 



thermal power plant, will be explored. Their calibration 
drift rates, noise figures, accuracy, and other errors will 
be examined. In particular, platinum resistance temperature 
detectors (RTDs) will be discussed as a specific case-in-depth 
to illustrate the origins and nature of some of the instru- 
mentation errors. Reference (10) contains a comprehensive 
collection of literature on various industrial thermometers. 
Then in chapter 4, the techniques of minimizing the effects 
of these errors will be explained in detail. 

Even without dwelling upon the theories of probabilities 
and statistics, one can assume that the probability for three 
different types of instruments (a triply redundant case) to 
generate similar errors (both in sign and magnitude) is very 
remote. It is here that redundancy demonstrates its most 
salient advantage. The use of redundant instrumentation 
coupled with the technique of averaging or voting will yield 
the most reliable and least noisy signal at all times, as 
the reader will see in chapter 4. 

B . Resistance Temperature Detectors 

Two of the most widely used temperature sensing 
devices are resistance thermometry and thermoelectric 
thermometry. Resistance thermometry can be divided con- 
veniently into two basic groups: resistance temperature 

detectors (RTDs) and thermally sensitive resistors 
(thermistors). Thermoelectric thermometry will be discussed 
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later. RTDs are basically electrical circuit elements formed 
of solid conductors (usually in wire form) that are charact- 
erized by a positive coefficient of resistivity. The RTDs 
of general usage are of platinum, nickel, and copper. 

There is no question that platinum is one of the best 
materials for a resistance temperature detector, nevertheless, 
it exhibits certain calibration drifts and errors during both 
testing and normal operations. A thorough evaluation was 
conducted on the performance of several industrial platinum 
thermometers between 0° and 650°C by the Oak Ridge National 

Laboratory, and some of the findings are briefly summarized 

( 11 ) 

in the following pages. 

1 . Insulation Resistance 

Consideration of insulation resistance is 
significant because it could indicate that measurement 
errors might be caused by shunting of the sensing 
element due to leakage of current to the sheath and bet- 
ween lead wires . In the experiment conducted by the 
Oak Ridge Laboratory, it was found that insulation 
resistance varied widely for similar type of thermometers, 
but from different manufacturers. But more importantly, 
it was also discovered that even for thermometers in 
the same group purchased from the same manufacturer, 
resistance differences of several decades were not 



uncommon 
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2 . Thermal Emf's 

Experimental results indicate that in order 
to reduce thermal emf's, parallel lengths of wires in 
the thermometer must have similar thermoelectric 
properties, and thermal gradient between lead and 
points of lead attachment must be minimized. 

3 . Calibration Drift Test 

A summary of the calibration drift test 
results is tabulated in TABLE 2.1. 

TABLE 2.1 



Number of thermometers 
tested 

Number that failed 
immediately 

Number that failed within 
1000 h 

Number that survived 
6000 h 

Maximum differential 
drift in °C, after 6000 h 

Maximum absolute drift 
in °C after 6000 h 



Manufacturer 



BCD 
2 4 5 

110 
2 10 
0 3 5 

1.0 0.5 



1.1 



0.9 
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In the worst case, the absolute accuracy of the 
thermometers changed approximately 1°C. Some thermo- 
meters had positive errors, while others developed 
a negative drift. 

4. Thermal Cycling 

All thermometers survived 1000 cycles without 
breakage after they we re cycled between 260°C and 
50°C. When the temperature limits were changed to 
cycle between 760° and 80°C at a maximum rate of 8°C/sec, 
half of the thermometers failed within 31 cycles. 

5 . Effect of Crystal Defects 

It is obvious from the preceding paragraphs 

that platinum RTD may cause certain temperature drift 

during service, and may even fail when subject to 

severe thermal cycling. Errors may also occur as a 

result of crystal defects or fabrication imperfection. 

The introduction of such physical defects into a 

crystalline material like platinum, will cause an 

increase in its electrical resistivity and therefore 

4 . 4 . ( 12 ) 

an error on its output. 

C . Thermistors 

Thermistors are electrical circuit elements formed 
of solid semiconducting materials that are characterized by 
a high negative coefficient of resistivity. At any fixed 
temperature, a thermistor acts exactly as any ohmic con- 
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ductor. Typical thermistor resistance variations are from 
50,000 X1 at 38°C to 200 X1 at 260°C.^ 13 ' ) 

Some of the semiconductor materials that are commonly 
used to manufacture thermistors are carbon, germanium, and 
silicon. The author will concentrate on the application 
of thermistors to temperatures below 100 K or -173°C. 

There are two important reasons for this selection. First, 
materials and methods of thermometry which are well developed 
for higher temperatures often fail at lower temperatures. 
Second, problems associated with the application of ther- 

(14) 

mistors become more serious as the temperature is reduced. 

1. Temperature Dependence 

When carbon resistance thermometers are 

monitored at a fixed low temperature, their resistance 

is observed to drift with time. As the temperature is 

lowered, the drift becomes more serious. If one requires 

a stable carbon resistance thermometer, he must sacrifice 

temperature resolution. Part of this loss in resolution 

can be restored, however, by using a resistance bridge 

( 1 5 10 ) 

capable of a greater resolution. v ’ 

2. Power Dissipation 

The measurement of resistance requires power 
dissipation in the thermometer. Thus, power dissipation 
must be kept small to avoid excessive measurement error. 
It has been found that a power dissipation as little as 
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-12 

5x10 W in a carbon resistor at 0.04 K caused about 
a one percent error in AT/T.^ 1 "^ 

3 . Self Heating 

Another problem that is not so easily detected 
is power dissipation resulting from rf voltages induced 
in the leads by commerical radio transmitters. This 
effect is known as self-heating and is a problem common 
to both carbon and germanium thermistors. Error caused 
by such spurious power dissipation becomes much more 
serious as the temperature is reduced. In areas exposed 
to large rf fields, the electronics must be placed in 
a shielded enclosure; otherwise, the placement of a low 
pass filter in the electrical lead near the resistance 
thermometer may be sufficient. An efficient and ade- 
quate heat sink also appears to be an effective method 

(17) 

to minimize such error. 

D . Noble Metal Thermocouples 

Obviously, a perfect thermocouple would be one that 
produces an emf signal that is uniquely related to the temp- 
erature of the hot junction and is unaffected by time or any 
other factor. Although noble metals like platinum are 
superior to most, no materials of construction are completely 
stable in this regard. Mechanical failure is a major 
contributing factor to instrument malfunction, but in the 



38 



absence of that, thermocouple deterioration is usually caused 
by changes of composition which influence the emf developed 

over the temperature gradient to which the couple is 

, . . . (18) 
subjected. 

A highly corrosive environment appears to be the major 
cause for compositional changes. Most environments above 
1300°C are fairly hostile; in addition to vapor transport 
processes associated with the formation of volatile oxides, 
chemical reactions can also occur between the thermocouple 
wires and the insulating materials with which they are in 
contact. 

1 . Contamination 

Mechanical failures of platinum thermocouples 
are sometimes caused by contamination during fabri- 
cation. The embrittlement, which sometimes occurs 
when platinum thermocouples are heated in contact with 
alumina insulators under reducing conditions at temp- 
eratures above 1200°C, is usually associated with 
the presence of silicious impurities in the refractory. 
This type of reaction results in the formation of low 
melting point alloys, and the thermocouple usually 
fails abruptly before a serious change in thermal emf 
has occurred. ^ ' Silicious impurities are usually 

introduced during the wire drawing process of platinum. 
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2 . Thermal Drift 

Thermoelectric stability becomes an important 

issue when an instrument operates continuously for 

thousands of hours. Experimental results indicate that 

thermal drift is related to compositional changes 

because the drift has been found to be a direct result 

of change in the chemical composition or metallurgical 

structure of the thermocouple materials after exposing 

( 19 ) 

to a thermal gradient. 

Some of the operating conditions that affect the 
amount of thermoelectric drift are as follow: 

(a) temperature level, (b) time, (c) temperature gradient, 
(d) environmental gas, (e) pressure level, (f) thermal 
cycling, and (g) nuclear radiation. 1 

3 . Temperature Errors due to Catalytic Surface Burning 

V/hen a metal thermocouple is exposed to various 
incompletely-burned gases that exist in some engine 
exhaust gases, it is entirely possible for catalytic 
burning to occur on the surface of the thermocouple. 

This burning will raise the temperature of the ther- 
mocouple to a value that is higher than that of the 

(20 21 ) 

surrounding gas medium. ’ 

In order to eliminate catalytic reaction, design 
engineers have recommended coating the temperature 
probe with a non-catalytic material. Some of these 
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non-catalytic coatings include potassium-chloride and 
oxidized chromium. 

E . Variable Resistance Pressure Transducers 
1 . Potentiometric Pressure Transducers 

A potentiometric pressure transducer is a 
device consists of three main components: the force 

collector, the sliding contact wiper, and the resist- 
ance wire winding. The pressure to be measured is 
applied to the force collector which , through a linkage 
rod, moves a sliding contact across the electrical 
resistance wire windings, thus producing a voltage 
proportional to the pressure. A diagram that illustrates 
the basic operating principles of such transducer is 
shown in appendix I. For more detailed descriptions 
and specifications of various commercially available 
pressure transducers, the AGARD publication "Wind 
Tunnel Pressure Measuring Techniques" (23) and the 
ISA "Transducer Compendium" (24) may be consulted. 

Resolution and electrical noise are the two most 
severe problem areas associated with the use of 
potentiometric transducers, especially those employing 
wire winding resistance elements. As the wiper moves 
across the windings, a step resistance change is 
generated when the wiper disconnects with one winding or 
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makes contact with another. The amplitude of this step 

change, and therefore the resolution, depends mainly 

upon the geometry of the wire windings and wiper. A 

nominal value of resolution for most potentiometric 

(25 20 ) 

transducers is 0.2 percent of full scale. ’ 

Electrical noise is generated due to variation in 
contact resistance as the \-/iper travels over the 
resistance element. Contact pressure fluctuations and 
particle contamination at the wiper-wire contact are 
usually the causes for these variations. This noise 
generation tends to increase with the life of the 
instrument because of wear and misalignment of the 
wiper and track. Noise spikes may also be caused by 
variations which tend to lift the wiper from the 
resistance element. In addition, any linkage required 
in the transducing system will cause the instrument to 
be more sensitive to vibration. Recent transducer 
designs use the method of oil damping on the linkages 
and elastic elements to reduce the harmful effects 
of vibration. 

In general, the potentiometric transducers should 
be used in areas of low acceleration primarily for the 
measurement of static pressures. 
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2. Strain-Gage Pressure Transducers 

A strain-gage pressure transducer is an instru- 
ment in which a pressure change caused by the strain in 
a strain gage is converted into a change in resistance. 
More details on this type of transducers and their 
electrical schematic diagrams can be found in appendix I. 

Full-scale pressure ranges from 0 to 0.1 psi to 
0 to 100,000 psi are provided from various types of 
strain-gage transducers. In some models, static error 
bands as low as 0.1 percent of full scale can be 
achieved. If temperature compensation technique is used, 
transducers with temperature sensitivities as low as 
0.25 percent of full scale can be fabricated. Most 
strain-gage transducers are somewhat sensitive to 
acceleration and vibration. Moreover, in pressure ranges 

below 10 psi, errors of 0.5 percent of full scale per 

( 23 ) 

g are not uncommon. 

F. Diaphragm-Type Variable Reluctance Transducers 

A variable reluctance pressure transducer commonly 
used in the power industry employs a magnetic diaphragm as 
the sensing element, supported between two inductance core 
assemblies. The diaphragm deflects when a differential 
pressure is applied to the pressure ports, thus changing 
the magnetic flux. A detailed diagram of such transducer 
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is shown in appendix I. 

One of the major advantages offered by this type of 

transducer is its sensitivity and acceleration capabilities. 

Pressure sensitivities as high as one volt per psi are 

available, and pressures down to 0.00003 psi may be measured 

In addition, due to the extremely low seismic mass of this 

sensing device, it is capable of withstanding high levels 

( 27 ) 

of acceleration.. 

A major disadvantage of this transducer is its sus- 
ceptibility to particle contamination. If the fluid 
contains particles, they may easily become lodged in the 
small air gap 0.001 in) between the core and the 
diaphragm. Consequently, the performance of the instrument 
is degraded either by mechanical or magnetic interference. 

A second disadvantage of using this type of inductive 
transducer is that AC excitation must be used. 

G . Piezoelectric Pressure Transducers 

Piezoelectricity is defined as an electrical polar 

ization produced by mechanical strain in crystals belong to 

certain classes, the polarization being proportional to the 

strain and its sign related to the direction of the strain. 

If a piezoelectric element is stressed mechanically, its 

( 28 ) 

dimensions change and an electric charge is generated. ' 
This type of sensor does not require external electrical 
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power as does the variable resistance or the variable^ 
reluctance transducer. A variety of piezoelectric materials 
are used, with quartz, barium titanate, lead zirconate tit- 

anate , and ceramic elements being some of the more common 

, . (25) 

choices . 

Piezoelectric elements have an inherent high internal 

resistance (10^ to 10 ^ ohms) and a low capacitance (5 to 

500 pF) ; thus, a slight leakage resistance path across the 

element electrodes or across the electrical connector pins 

can cause erratic operation and limit the low frequency 

response of the sensor. Therefore, it is important to 

carefully protect the piezoelectric element and all connector 

from moisture or other contaminants that might create con- 
( 23 ) 

duction paths. 

H. Vibration Type Liquid Densitometer 

In the vibration type liquid density measuring 
system, the vibrating tuning fork is the basic principle of 
operation. The density device uses a hollow vibrator element 
similar to a tuning fork, through which the measured liquid 
flows . As the density of the measured liquid changes, the 
mass and the resonant frequency also change. In fact, the 
frequency is inversely proportional to the square root of the 
density, oo = K/./p’ . An electrostatic capacitive pickup 
electrode connected to an amplifier converts the vibrator 
displacement to an alternating voltage output, which corres- 
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ponds to the density of the liquid. 

Hardly any study has been conducted on the vibration 

type liquid densitometer, thus the origins and nature of 

errors associated with this type of densitometry are not 

commonly known. One can, however, obtain an idea of the 

capabilities of such an instrument by the following speci- 
.(29) 



fications 

Measuring range : 
Span : 

Repeatability : 
Linearity : 

Working Pressure: 



0.5 to 1.5 g/cm° 

3 

0.05 to 0.5g/cm 

1 % of span 

- 0 . 5 % of span 
2 

20 kg/cm G or less 



Working Temperature: -10 to 100 C 



I . Concluding Remarks 

In this chapter the author has not attempted to 
cover any particular instrument in great detail; in fact, 
that would be beyond the scope of this thesis. If more 
detailed descriptions are desired, the reader is advised to 
consult appendix I and some of the references listed. 

If the reader has learned nothing else in this chapter, 
the author hopes that he is now at least more aware of the 

fact that different instruments behave so differently under 

/ 

the same environmental conditions. One instrument may 
yield a higher than normal reading, whereas a second one may 
produce an unusually low measurement; yet a third sensor 
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may simply fail completely. 

In chapters 3 and 4, the author will discuss the prin- 
ciples and advantages of averaging, mediating, and voting, 
as applied to a control system using redundant instrumentation. 
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CHAPTER III 
PROBABILISTIC LOGICS 



A. Introduction 

Probabilistic logics entail the study of error in 
logics, or in the physical implementation of logics. Error 
is viewed, according to J. von Neumann, not as an extraneous 
or misdirecting accident, but as an essential part of the 
process under consideration.^ 33 ^ Actually, the study of 
probabilistic logics has a far greater influence; its 
implementation can be considered as the predecessor of all 
multiplexing techniques (a fundamental concept for voting) 
and coding methodologies (encoder and decoder), as the reader 
will see more clearly in the paragraphs to follow. 

B. Logics and Automata 

A. M. Turing ^ 31 ^ in 1937 and W. S. McCulloch 1 ' 32 J 
in 1943 suggested that probabilistic logics can be best 
studied in terms of automata. An automaton, as defined 
by von Neumann, is essentially a "black box" with a finite 
number of inputs and a finite number of outputs. Each 
input and each output is capable of exactly two states, to 
be designated as the "stimulated" state and the "unstimul- 
ated" state, respectively. 

The internal functioning of such a "black box" is 
equivalent to a set of specifications determining which 
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outputs will be stimulated in response to stimulation of 
any group of inputs. The definition just mentioned is 
precisely the concept that an averager or a voting cir- 
cuitry (two of the most commonly used multiplexing tech- 
niques) is based upon. In addition, the theory of auto- 
mata can also be applied to the tasks of encoding and 
decoding in which a specific number of inputs can be con- 
verted into either fewer, same, or greater number of out- 
puts, depending upon the specifications of a particular 
"black box". Therefore, an understanding of probabilistic 
logics is useful if one wishes to learn more about the 
never-ending quest of higher reliability in a control 
system. 

C . The Technique of Multiplexing 

If the inputs and outputs are bundled together, 
an automaton can now be represented like that in Fig. 3.1. 

All messages will be carried simultaneously on a bundle of 
N lines (N being a large integer) instead of just a single 
or double strand. Instead of requiring that all or none 
of the lines of the bundle be stimulated, a certain critical 
(or fiduciary) level A is set: 0 < A < /£. The stimulation 
of > (1-A) N lines of a bundle is interpreted as a positive 
state of the bundle. The stimulation of < A N lines is 
considered as a negative state. Any other number of stimulated 
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line is interpreted as a malfunction. By constructing the 
automaton appropriately, it can be shown that the number 
of lines deviating from the "correctly functioning" 
majorities of their bundles may be kept at or below the 
critical level A N (with arbitrarily high probability) . 

J. von Neumann called such a system of construction "multi- 
plexing" . 



a 

b 

c 



X 

3 



Each group ===== represents 
a bundle of N lines. 

Fig. 3.1 Automaton as A Black Box 

The technique of multiplexing requires that the comp- 
lete system must be organized in such a manner, that a 
malfunction of the entire automaton cannot be caused by the 
malfunctioning of a single component, or of a small number 
of components, but only by the malfunctioning of a large 
number of them. As the reader may observe, the probability of 
such occurrence can be made arbitrarily small provided the 
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number of lines in each bundle is made sufficiently large. 

D . Von Neumann's Majority Organ 

1 . The Basic Executive Organ 



if the majority of the inputs malfunction led to the 
invention of the majority organ by von Neumann in 1952. 
The majority organ will be able to handle, bundle of 
inputs and outputs as well as single lines. For the 
sake of simplicity, however, the majority organ will be 
modelled as a black box with three single line inputs 
a, b, and c of similar characteristics, as shown in 
Fig. 3.2. 

m(a,b,c) = ab + ac + be = (a+b) (a+c) (b+c) (3.1) 



The criterion that a control system fails only 



The Majority Organ 



a 

b 



c 



© 




Fig. 3.2 



Here m(a,b,c) represents the majority of the input signals 
a, b, and c; ab denotes a and b, whereas a+b defines a 
or b. Using the majority organ, it is clear that if any 
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two of the three inputs are stimulated, the output 
will be stimulated. Similarly, if any two of the inputs 
are not stimulated, the mechanism will not stimulate 
any output at all. 

Thus, it appears that the majority organ can also 
be called the basic executive organ because it executes 
the desired basic operations on the bundles. After the 
execution, however, the degradation caused by the 
executive organ must be erased; moreover, the stimulation 
level of the inputs has to be restored. These two require- 
ments necessitate the creation of a second organ the 

restoring organ. 

2 . The Restoring Organ 
a. Construction 

The restoring organ can be constructed with 
little difficulties and in fact, the ordinary major- 
ity organ already performs this task in a crude way. 

If one considers the simple case of having three 
signals at the input like that shown in Fig. 3.2, 
it should be obvious to the reader that the major- 
ity organ suppresses a single incoming impulse as 
well as a single incoming non-impulse. In other 
words, it amplifies the presence as well as the 
absence of the incoming impulses. 

Before continuing any further, one note of 
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importance that should be emphasized here is the 
following: In order to apply the theories of 

probability and statistics to the majority organ 
concept in various applications, all inputs must 
be considered as statistically independent. 

What are the advantages of multiplexing? As 
mentioned earlier, the most desirable feature of 
a multiplexed system is its ability to control 
errors. It can be shown by statistical analysis 
that, by using large enough bundles of lines (N 
being the size of the bundle), any desired degree 
of accuracy can be obtained with a multiplexed 
automaton. Of course, economics and implement- 
ation difficulties may dictate the largest num- 
ber that N can take on. 
b . Numerical Evaluation 

Does the majority organ really perform 
the task of a restoring organ? The following 
evaluation will attempt to prove just that. 

If there are N incoming lines and oc N of 
them are stimulated, then the probability of any 
majority organ being stimulated is 

cC* * = 3 oC 2 - 2c6 3 . (3.2) 

* 

Provided N is large, approximately cC N outputs 

* 

will be stimulated. A curve of oC against 06 
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is plotted in Fig. 3.3. 

Numerical Evaluation of 
the Majority Organ 



* 

oC 




Fig. 3.3 



* 



The curve intersects the 


diagonal 


oC 


= 


cC 


three 


times, at 06 = 0 , 


V z , and 1 . 


For 0 < 


cC 


< 


3 ^, 


the 


curve indicates 0 


* 

< oC < oC 


; for V 2 


< 


o C 


< 


1 , 


-K- 

the plot shows that oC < oC 


< 1 . 


In 


fact , 


sue- 


cessive iteration 


of this process converges 


oC 


to the asymptote 


at 0 if the 


original 


a C 


< 




and 


to the asymptote 


at 1 if the 


initial 


oC 


> 




This 



is precisely the process of restoration for a digital 
system, to bring o C nearer to either 0 or 1 , to which 
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it was nearer originally. Thus it is shown that 
the majority organ does possess the desired 
characteristics of a restoring element. 

E . Majority Organ Operations in a Digital System 

Professor H. M. Paynter of M. I. T. went one 

step further to develop the AND and OR logic elements in 
( 33 ) 

more detail. In digital or binary logic, the output 

can only take on the value of either 0 or 1. As in set 
theory, one can represent the AND operator with the inter- 
section symbol A , and the OR operator with the union 

. n ,, (34) 

symbol V . 

If there are two independent variables X^ and X^, then 
the operations of union and intersection may be represented 
in the functional matrix form as shown in Fig. 3.4. 



Operations of Union & Intersection 



X 



1 



X x V 


X 2 


0 


1 


x 2 


0 


0 


1 




1 


1 


1 



X 



1 



A x 2 


0 


1 


0 


0 


0 


1 


0 


1 



Fig. 3.4 



55 



The reader might notice the similarity between the 
above matrix and a conventional truth table. In fact, if 
the symbols T (truth) and F (falsity) are substituted for 
1 and 0, respectively, a truth table would have been con- 
structed. 

If the inputs are 3-bit binary words, the operations 
of union and intersection produce some fairly interesting 
results. For example, if X^ = Oil (3 in base 10) and 
X 9 = 100 (4 in base 10), then the operations of V and A 
may be represented in Fig. 3.5. 



X ± = 0 1 1 

x 2 = 1 0 0 



x x v x 2 



10 0 



x x A x 2 

Oil 



Union & Intersection of a Binary word 



Fig. 3.5 

The results in Fig. 3.5 indicate that the operation of 
union produces the larger of the two 3-bit words, whereas the 
operation of intersection yields the smaller of the two words. 
This concept will be developed further when continuum logic is 



discussed. 
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F . Multi-valued Logic 

One may conceive a spectrum of multi-valued or 

n-valued logics with binary and continuum logics occupying 

the extreme positions. This concept was first introduced 

( 35 ) 

by H. Reichenbach in 1932, then evaluated further by 

/ q r \ 

P. C. Rosenblooirr ' in 1950. It was not until 1960, 
however, that the idea of multi-valued logics was linked to 
the study of control systems by H. M. Paynter. 

In two valued logic, absolute falsity is designated by 
the value 0, whereas absolute truth is assigned the value of 
1. On this line of continuum logic, any other values that 
lie between 0 and 1 may be interpreted as "partial truth" 
as proposed by Paynter. In a four valued logic, for example, 
the truth values might be viewed as "truth", "plausibility", 
"implausibility" , and "falsity". 

In the system proposed by E . L. Post, ° ' there are n 
truth values which may be denoted by 1,2,3,..., (n-1) , and 
n. The operation of the intersection A can be defined by 
the matrix shown in Fig. 3.6. 

This logic of propositions for the case of multi-valued 
logics is known as Post algebra, as opposed to the Boolean 
algebra for the two valued case. 
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Post Logics 



Fig. 3.6 

G. Analogy Among Binary, Multi-valued, and Continuous Logics 
Binary logic can be defined as discrete logic , one 
that consists of only 0's and l's. A three-valued logic is 
composed of 0's, ){' s , and l's. On the other hand, an analog 
logic or continuous logic can take on infinitely many values 
between 0 and 1. Fig. 3.7 shows undeniable similarities 
among binary, three-valued, and continuous logics. ’ 
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Z = V (X,y) 





Fig. 3.7 Similaries Among Different Logics 
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Z = A (x,y) 






Fig. 3.7 Similaries Among Different Logics 
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An analog analogy of the majority organ as first pro- 
posed by H. M. Paynter will be presented later in this 
chapter . 

H . From Digital to Analog via Multi-valued Post Logics 
Since the concept of multiplexing and the prin- 
ciple of the majority organ were first introduced by von 
Neumann, a great deal of contributions has been made by 
others in the area of reliability of binary system com- 
posed by subsystems interconnected in various ways by 
different kinds of restoring elements. However, primary 
signals from many instrumentation, control, and communi- 
cation systems are still in a continuous or analog form. 

It is true that much of the work dealing with redundant 
digital systems can be carried over to analog systems, but 
the unique characteristics of a continuous analog signal 
necessitate a separate study. 

Unlike the simplicity of a digital system with its 
strings of 0's and l's, or the multi-valued system with 
its finite set of values, an analog signal is much more 
complex with its infinitely many forms and values. It 
was Paynter who first formulated an analogy between digital 
restoring elements and the upper and lower selectors used 



in an analog system. 
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I . Continuum Logic 

In the world of digital 0's and l's, von Neumann 

used the AND and OR organs as the two building blocks for 

his majority organ. Similarly, H. M. Paynter uses the 

upper and lower selectors to construct his median-taking 

( 33 ) 

element for an analog system. Paynter defines the 

union operator V as the upper selector: 



V X(k) = X(k ) (3.3) 

max 

and the intersection A as the lower selector: 

A X(k) = x ( k min ) (3.4) 

where {X(k)} is defined as an aggregate of classes such 
that X^l 'k = 1 , 2 , 3 , •. . . ,n. Fig. 3.8 shows the upper and 



lower selectors in symbols. 

If X represents a group of time-varying functions, 
the following will hold true: 

X s X ( t ) = { X, ( t ) k = 1,2,3,.. .,n} (3.5) 

If the upper and lower selector operators are now 
performed on a set of signals as shown in Fig. 3.9, 

V {x(t)} will represent the greatest of the X^. at time 
t, whereas A {x(t)} will depict the least. 



J . Operations of the Majority Organ in an Analog System 
As suggested in section D of this chapter, the 
majority organ can be represented in the following Boolean 
relationships: 
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M (X 1 ,X 2 ,X 3 ) == (X x AX 2 ) V (X 1 AX 3 ) V (X 2 AX 3 ) 

= (x^ x 2 ) A (x 1 vx 3 ) A (X 2 VX 3 ) 
In symbols, these relationships are modelled in the 
configurations shov;n in Fig. 3.10. 
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Operations of the Upper and Lower Selectors 




Fig. 3.9 



If X 1 (t), Xg ( t ) , and X^Ct) represent three similar 
sinusoidal signals but saturated with different noise and 
distortion like that shown in Fig. 3.11, then fMI (X^jX^jX^) 
actually takes on the median value at any time t. Using 
the same symbols as shown in Fig. 3.11, y represents a 
continuous median signal. 

In chapter 4, averaging and voting, the two multi- 
plexing techniques that are most widely used, will be 
discussed in detail. 



The Modelling of the Majority Organ 
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Selection of Continuous Median Signal 
Special Case of Three Signals 



3 




Fig. 3.11 
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CHAPTER IV 

AVERAGING, MEDIATING, AND OTHER VOTING SYSTEMS 

A . A Need for Redundancy 

A control system needs to be monitored on a con- 
tinuous basis; but if the instruments that monitor the 
system performance are themselves not completely reliable, 
then the system reliability is jeopardized. The control 
system must act on the basis of signals transmitted from 
the measuring instruments. If, however, these signals are 
faulty or inaccurate, then the system can no longer achieve 
optimal or even safe operation. 

The importance of redundant instruments in a control 
system cannot be overemphasized. As already mentioned in 
chapter 1, if only one instrument is used to monitor a 
critical parameter, the failure of that instrument could 
often lead to catastrophe. 

Obviously, if a second instrument is installed to 
monitor the same parameter, the probability of system 
failure is considerably decreased. For example, if an 
averager is used to process the signals from two redun- 
dant instruments, the output is clearly more reliable than 
the output from a single sensor. The difficulty arises, 
however, when the two transducer signals are vastly different 
from each other. Here the dilemma leads to the following 

question: Which signal should one choose? In addition, 
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even when the faulty instrument is identified, a doubly 
redundant system does not allow for hot-repair. 

Here, the advantages of a triply redundant instru- 
mentation system become highly significant. In the 
technique of averaging, with one signal going astray, the 
output is only slightly in error. In the method of voting, 
however, as long as only one signal is erroneous, the out- 
put remains correct. Furthermore, even when two signals 
have failed, but if one failed high while a second one 
failed low, the output still maintained a correct value. 

And finally, in view of the tremendous economic penalty for 
downtime, the fact that voting allows for hot-repair of a 
faulty instrument makes it especially attractive for a 
thermal power system. 

The reader v/ill learn more about a triply redundant 
instrumentation system in the paragraphs to follow. 

B. Transition from Digital to Analog to Digital 

John von Neumann's majority organ for a binary 
system was first introduced in chapter 3. In a binary 
system, as already illustrated in the last chapter, the 
input and output signals can be easily represented by 
strings of 0 ' s and l's. The majority-vote logic element 
can be constructed with a combination of two basic 

elements AND and OR gates. In fact, it is a relatively 

straightforward task to demonstrate the operations of the 
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majority organ in a binary system, as already done in chapter 
3 for a simple case. 

Since the majority-vote logic was first introduced by 

von Neumann in his series of lectures at Caltech (California 

Institute of Technology) in 1952, a tremendous amount of 

works, both theoretical and experimental, has been conducted 

in the 1960's and 1970 's to evaluate the reliability of 

digital systems using redundancy. It was in 1958, only 6 

years after von Neumann presented his majority logic concept, 

Paynter formulated an analogy between digital restoring 

elements and the upper and lower selectors used in an analog 
( 33 ) 

system. As mentioned in chapter 3, the unique character- 

istics of analog signals from most instrumentation make it 
necessary to conduct a separate study to analyze the appli- 
cation of mediation to an analog system. The experimental 
work conducted by Karnopp and Bender in 1966 verified the 

advantages that one would gain in the utilization of averaging 

( 2 ) 

and mediation in an analog system. 

A symposium on digital redundancy in 1962 may very well 

have started the transition from analog to digital with full 

speed. In February, 1962, a two day symposium was held in 

V/ashington, D.C. on Redundancy Techniques for Computing 
( 39 ) 

Systems in which a total of more than 20 papers were 

presented by various design engineers and mathematicians. 

The collection of papers was fabulous; it represented the 
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hard work and dedication of numerous distinguished people. 

With the advent of digital technology in the 1960's, 
digital redundancy using the voting technique began to be 
found in various applications. The idea of a voting cir- 
cuitry is not new, but its implementation in the industries 
has definitely been an area full of innovations. During 
the past few years in particular, industrial implementations 
of redundancy are becoming more and more common everyday. 
Among some of the more prominent examples are the Space 
Shuttle program, the strapdown redundant inertial instruments 
for military ballistic missiles , ^ 40 ^ and the Bell System 
Electronic Switching Systems (ESS).^ 41 ^ In fact, reports 
in this area have appeared on a regular basis in journals 
such as the IEEE Proceedings, AIAA Guidance and Control 
Conference Transactions, Electronics, etc. 

C . Averaging Multiplexing Technique 
1. Introduction 

The averaging method can be considered as 
one of the oldest yet extremely useful techniques to 
improve the reliability of a signal or data. One is 
familiar with the situation in which a photographer 
takes two or three spot readings with his light meter, 
then uses the average of the readings to set the 
aperture and shutter speed on his camera. 

t 

A straightforward averaging technique involves 
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simply taking the arithmetic mean of a series of readings; 

in other words , the weight factor is equal for all channels. 

This operation, performed by a device to be called an 

averager, reduces the failure rate of the measuring system 

according to the total number of sensors. However, 

noise or error in any one of the inputs still affects 

the averaging output. If one knows a priori that a 

certain channel is more reliable than others, then a 

heavier weight factor can be assigned to that channel, 

(42) 

thus increasing the overall reliability. 

An even more elaborate "average" method is also 

available as a multiplexing technique. Here the word 

"average" is in parenthesis because this method resembles 

the voting technique more than the ordinary averaging 

method. In this methodology, weight factors for each 

channel are continuously changing based on cross-channel 

( 43 ) 

differences among the several channels. More on this 

method later in this chapter. 

2 . Functional Block Diagram 

A typical multiplexed system can be represented 
by means of a block diagram like that shown in Fig. 4.1. 

Here the actual multiplexing technique can be averaging, 
vote-taking, or something more complex. The physical 
variable can be temperature, pressure, or any other 
engineering parameter. The noise at each channel may 
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variable 




Fig. 4.1 Typical Multiplexed System 
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Fig. 4.2 A Linear Vote-taker 
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be one of the following types: transmitted noise, in- 

herent noise, or induced noise. The block diagram 
represents a triply redundant case. 

3 . Principles of Operations 

An averager which takes a linear combination of 

(42 ) 

its inputs to form its output is shown in Fig. 4.2. 

Once again, a triply redundant case is presented here; 
obviously, one may extend the technique for higher order 
redundant systems. Here the three input signals are 
assumed to be identical, but with different noise levels 
superimposed on them. As mentioned earlier, if the 
weight factors, a^ , a 2 , and a 3 all have the value of 
1/3, then the output simply will be the arithmetic mean 
of the input signals. If we designate the output as 
X Qut , then the output of the averager is given by the 
relation : 

i 5 

y - ± y y 
out ~ 3 n 

which can be generalized to any number of signals. 

One of the limitations of a straightforward averaging 
method is that a number of consistently unreliable channels 
may degrade the quality of the output. This limitation 
may be overcome, however, if the reliable inputs are 
given heavier weight factors and the unreliable inputs are 
given lighter weight factors. Clearly, the reliability 
of such tailormade system must be determined on an 
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individual basis. 

4. Reliability Calculations 

In the averaging method, the output will be 
somewhat faulty if any one or more of the inputs is 
faulty. It is clear that the probability of a faulty 
output is higher than the probability of failure at 
any individual channel. This shows that if the control 
system requires that the output must always be exactly 
correct, then the averaging method may not be the 
optimal choice due to its high failure probability. 
Nevertheless, one must keep in mind that the averager 
output signal will not deviate as much as a single 
signal. Detailed reliability calculations and analysis 
for the averager will be performed in section F, along 
with those of the voting element for ease of comparison. 

5 . Experimental Verification 
a. Statistical Analysis 

An experiment was conducted by dePian and 

Grisamore to show the advantages of an averaging 

., . ...... (44) 

circuit over a non-averaging single circuit. 

A distribution of output values was obtained by 

applying the same input signal to both the 

averaging and the non-averaging circuits. After 

elaborate manipulation of the output data, the 

following relations were found: 
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For the non-averaging circuit (139 samples) 
tf = 0.075 
x = 0.174 

For the averaging circuit (44 samples) 

0 = 0.025 
x = 0.187 

The distribution curves for the two types of 
circuits are shown in Fig. 4.3. As one can inter- 
pret from the plot of normalized distribution of 
output signals (x) in Fig. 4.3, the average circuit 
has a considerably smaller standard deviation. It 
can be concluded that in general, the averaging 
technique provides more reliable output signals, 
b . Output Waveforms 

The improvement in signal quality of an 
averager output can be best seen from a set of 
analog signals. Time plots of three noisy input 

signals and the resulting output are shown in 
(45) 

Fig. 4.4. When only one input is noisy, 

the averager output has the same noise function 
as the input, but' reduced to one-third. 

If two of the input signals are noisy, the 
output noise level depends on the amount of 
correlation between the noisy functions on each 
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input. When all three inputs are noisy, the out- 
put noise levels increase but are still less than 
those of any of the inputs. 



Normalized distribution of output signals (x) 




Fig. 4.3 
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Averager Output 






Experimental time plots of averager output when 
one, two, or three input signals are noisy. In 
each case the upper three signals are the inputs 
and the lower signal is the output. 



77 



D . Voting Technique 

1 . Introduction 

A vote-taker is a generalization of the 
majority organ introduced by von Neumann. The output 
of a voter will always be the median value of the 
inputs. Voting operations in an analog system have 
already been performed in chapter 3. The operations 
of a voter circuitry on three 3-bit digital words 
will be conducted later in this section. 

2 . Implementation 

As already stated in the last chapter, the 

voting concept can be defined, in terms of Eoolean 

( 38 ) 

algebra, as the following relations: v ' 

M(x 1 ,x 2 ,x 3 ) = (x 1 v X 2 ) A (x 1 v X 3 ) A (X 2 V x 3 ) (4.1) 

where X^ X 2> and X 3 are digital input signals. 

The above concept can be easily implemented using 
the voter circuitry shown in Fig. 4.5. The circuit, 
in essence, produces an output which remains correct 
no matter in what manner a single channel fails. 

Critics of the voting principle often ask the 
following question: How does the failure rate of the 

voter affect the overall probability of error in a 
system? Obviously, if the voter is constructed of the 
same components as used in the rest of the system, no 
improvement occurs. The next step is to consider using 
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Fig. 4.5 Voter Circuitry 



extremely reliable parts for the voter. This in turn 
is followed by the suggestion that one should use these 
extremely reliable parts for the rest of the system, 
thereby creating the original condition with no increase 
in reliability over the non-redundant case. The last 
suggestion is highly impractical, however, because 
complexities of modern circuitries and economic con- 
siderations often prohibit the use of ultra reliable 
components throughout the entire system. 

Therefore, it can be concluded that if only the 
voting circuitries are made of highly reliable components, 
the overall system reliability will still improve. 
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A detailed calculation of the improved reliability- 
will be presented in the next section. 

One must realize that the voter in Fig. 4.5 is 
only a 1-bit machine. It is true that in this thesis 
all signals are assumed to be 16-bit parallel words; 
but a 16-bit parallel v/ord voting circuitry will take 
up several pages of circuit diagrams. In order to 
provide the reader with the perception of what a 
16-bit vote-taker would look like, however, a simpler 
3-bit voter is shown in Fig. 4.6. 

In Fig. 4.6 the binary words Oil, 100, and 101 
are used to illustrate the operations of such 3-bit 
voter. The purpose of the comparator is to assist 
the three OR gates to find the larger of any two 
3-bit words. As soon as any two bits have different 
values, the comparator will identify which bit has 
a value of 1, then command the converters to convert 
the rest of the 3 bits of the smaller binary word to 
have the same values as those of the larger binary 
word. In this way, the output at the OR gates will 
always be the larger of the two 3-bit words. The 
key to Fig. 4.6 provides an example for such operations. 

If one compares the three inputs with the output bit 
by bit, he would notice that the output bits do not 
represent the majority of the input bits. For example, 
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Fig. 4.6 A 3-Bit Voter 
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the most significant bit on the output does not represent 
the majority of the most significant bits on the three 
inputs. The reader may have noticed, however, that the 
output represents the median value of the three inputs. 
Other examples performed by the author show similar 
results. In this regard, the voter in a digital system 
is identical to the mediator used in an analog system, 
as discussed in chapter 3. 

3 . Reliability and Maintainability 

Here the reliability study is conducted for 
both the averaging and the voting techniques for 
comparison. One of the major advantages of the voting 
concept is that it does not require any failure 
detection. Failure detection, on the other hand, is 
essential for some fault-tolerant systems that use a 
tolerance renewal scheme to reconfigure the system 
around a faulty module using spare units, once the 
failed module has been isolated. 

When a channel fails by outputing a faulty signal, 
it is sometimes not easy to determine the exact cause 
of the fault; it can be a short or an open circuit, 
or a limit value such as a supply voltage. As long as 
only a single channel has failed, there will be no 
effect on the output signal (for a triply redundant 
case). Moreover, monitoring equipment can be set up 



) 
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to pinpoint the faulty channel when a particular signal 
deviates from the other two. Once the faulty channel 
is located, it can be serviced on line without affecting 
the overall operation of the control system, provided 
only that a second channel does not fail during the 
service period. As long as maintenance is available to 
replace the faulty unit, the probability of continuous 
failure-free service is greatly increased. 

In this reliability analysis, all input signals are 
considered to be noise-free, but to have the possibility 
of being at false value. A false value at the input is 
defined as a failure of an input signal. A clear defini- 
tion of an output failure is not established; instead, 
the probability that at least one, two, or three input 
signals have failed will be plotted as a function of 
individual signal failure probability. 

The probability that at least f out of 3 inputs 

fail, Pr(f), is the probability that f, f-1 , etc. signals 

fail; based on the binomial expansion theorem, Pr(f) 

(45 46) 

can then be defined as follows: ’ 

Pr (f ) = S — P 1 (1-P) 3-1 (4.2) 

i=f ( 3-i ) ! i! 

where P is the probability of an individual input 



failure . 
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Probability of Individual 
Subsystem Failure, P 



Fig. 4.7 



Probability that at least (1), (2) or (3) 
signals are faulty vs. individual signal 
failure probability 



In Fig. 4.7 the probability, Pr(f), that at least 

f of 3 channels fail is plotted against the constant 

probability, P, that any one of the signals may be faulty, 

for f = 1, 2, 3. From this graph, one can obtain an 

indication of the failure probabilities for the averaging 

( 45 ) 

and the vote-taking techniques. 

Curve 1 applies only to the averager since one of 
three channels fails for the voter has no effect on the 
output. For the averager, however, the output will be 
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faulty if any one of the inputs is faulty. Curve 1 
indicates that the probability of a faulty output of 
an averager is worse than the probability of failure at 
any single channel. Of course, the averager output 
signal will not deviate as much as an individual signal. 

Curve 2 of Fig. 4.7 represents the case of the 
vote-taker in which a faulty output will result whenever 
any two of its three inputs are faulty. If the channel 
fails by open circuiting, however, the output will not 
be affected. From the S shape of curve 2, it becomes 
quite clear that for well-designed channels with 
P << V z , the probability of a faulty output for the 
voter is very small compared with that for a single 
channel . 

Finally, curve 3 indicates the worst case when 
all three channels are faulty. Until all three inputs 
are faulty, an averager will still react to some extent 
to the correct signal as long as some information from 
the correct signal get through. The voter, on the other 
hand, will simply neglect the correct signal altogether 
as soon as two signals are faulty. 

Since the vote-taker can operate perfectly with a 
minority of channels failed, fast repair or replacement 
of a malfunctioned channel will sharply reduce the 
probability of system failure. This feature is especially 
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desirable in a thermal power plant if one considers the 
economic penalty associated with the shutdown of the 
plant for maintenance of instrumentation. 

Incidentally, the fact that a voter maintains a 
correct output even when a minority of its channels are 
faulty is a simple example of fault-masking, the ability 
to prevent the fault from being transmitted further 
downstream-. 

4 . Experimental Verification 

As in the case of the averager, it is consider- 
ably easier to visualize the sharp improvement in signal 
quality of a voter output from analog signals. Time 

plots of three noisy input signals and the voter output 

(45) 

can be seen in Fig. 4.8. When only one input is 

noisy, the voter output is completely clean. 

If two of the input signals are noisy, the output 
noise level is directly related to the. amount of 
correlation between the noise functions on each input. 
Careful examination of the output shows that the 
output waveform is identical with the noise-free signal 
for one-third of the time. 

Finally, when all three inputs are noisy, the 
output noise levels increase, but similar to the averaging 
technique, the noise levels are still less than those of 



the inputs 



Voter Output 






Experimental time plots of voter outputs when one, 
two, or three input signals are noisy. In each 
case the upper three signals are the inputs and 
the lower signal is the output. 
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5 . Reliability for Higher Order Redundancy 

The triply redundant case has been used 
throughout the analysis. One must realize that higher 
order of redundancy is also used. However, the triply 
redundant case is felt to be the most practical case 
because it is the lowest order of redundancy to which 
the voting concept may be applied. Obviously, one may 
easily extend all of the results for higher order 
redundant system in which Pr(f) may be represented by the 
following formula: 

Pr(f) = YL — P 1 (1-P) n_1 (4.3) 

i=f (n-i)! i! 

where n = order of redundancy. 

6 . Multiple Line Restoring Element 

In addition to the simple voter configuration 

shown in Fig. 4.5, there are other voter configurations 

that will yield higher reliability. Such an improved 

version is shown in Fig. 4.9. This arrangement is 

(47) 

called the multiple line restoring element. It 

consists of a group of N voting elements, each with 
N inputs. All of the lines from the input bundle enter 
each of the restoring elements, M.^ , M^, and . 

A more sophisticated technique is the triplicated 
voting method shown in Fig. 4.10. By dividing 
each of the parallel channels into a large number of 
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Fig. 4.9 Multiple line Restoring Organ 




Fig. 4.10 Triplicated Voting Technique 
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segments and taking a vote after each segment, it is 
now possible for the system to experience a sizable 
number of faults in all three channels and still 
perform satisfactorily, as long as the faults do not 
occur simultaneously in identical segments of two out 
of the three channels. The number of such segments in 
a system is referred to as the "level of voting". 

MTBF's vs. Levels of Voting 




Level of Voting (n) 



Fig. 4.11 
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Fig. 4.11 shows the improvement in reliability as the 
voting levels are increased in a parallel channel voter 
system. Assuming a non-redundant system with a 98% 
probability of non- failure, a three channel redundant 
system with two levels of voting should have its MTBF 
(mean time between failure) increased by more than 
5 times. Of course, the higher the levels of voting, 
the greater will be the MTBF's, as indicated from 
Fig. 4.11. One must realize, however, that cost is an 
important factor in determining the maximum level of 
voting that an engineer can design a system. 

E . Advanced Voter Technique 

1 . Introduction 

In an instrumentation control system that 

uses a voting circuitry like the one examined in the 

preceding section, whenever a channel fails, the output 

will show considerable transient due to the switching 

action of the voter. Sometimes, these transients 

could be severe enough to cause an adverse response in 

the total system. A new voter has been proposed to 

minimize such switching transients; the output is 

determined as a continuous smooth function of the 

( 43 ) 

redundant inputs using a weighted "average". 

2 . Principles of Operations 



This type of voter minimizes switching 
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transients on the output because the isolation of a 

faulty channel is accomplished through a continuous 

numerical weighting. The output is determined in 

such a fashion that the outlying (faulty) signals 

are heavily discriminated against, in favor of the 

signals that are fairly close. 

In section C the author briefly mentioned an 

averaging method that assigns heavier weight factors 

to more reliable channels. These weight factors, 

however, were determined a priori. The voter described 

in this section, on the other hand, uses weight factors 

that are dynamic and are continuously changing based 

( 43 ) 

on cross-channel differences. 

A block diagram of such voter is shown in Fig. 4.12. 
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Fig. 4.12 Advanced Voter 
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Obviously, if = 17 ^ = 1/3, then will 

simply be a mean value voter, or a simple averager, as 
already examined in section C. In any event, regardless 
of what values , 17 ^ , and 17 ^ take on, is always 

a continuous smooth function of , V^, and V^. 

Reference (43) provides a family of weight factors 
for a triply redundant voter. Some weight factors 
involve the exponential functions, whereas others are 
defined in terms of the hyperbolic functions. One group 
of weight factors that is of particular interest is the 
following : 



W ! " 



W 2 = 



W„ = 

o 



1 +1 



1 + 



1 +1 



V 1 - V 2 



v 2 - v x 



V 3 - V 1 



V 1 " V 3 



V 2 - V 3 



V 3 - V 2 



-1 



-1 



-1 



(4.5) 



The constant a is the tolerance parameter which is 
a measure of the allowable noise level in a given channel. 
Note that if the square of the cross-channel 

p 

differences, (V. - V.) , are all small, then the equation 

^ 3 

of V Qu .j_ will approach the following: 



V 



out 



V 1 + V 2 + V 3 



3 
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On the other hand, if 



V 1 ' V 2^ 2 



« 1 and 



both 



V 2 ' V 3 \ 2 



and 



V 1 - V 3 \ 2 



equation of V . reduces to V . 

out out 



» 1 , then the 



V 1 + V 2 



From the above analysis, it becomes clear that if 

is indeed the erroneous signal, then the weight factors 

will computationally vote out V Q in favor of the t\^o 

nearly identical signals V 1 and V Table 4.1 can be 

used to demonstrate just that. In this table computed 

values of V ^ for a range of values of , V^, and Vg 

are tabulated. Formulas used for V , and W, to ¥_ 

out 1 3 

are equations 4.4 and 4.5, respectively. 

As the reader can see, these v/eight factors are 
constructed to discriminate against a possible failed 
signal in favor of the remaining good signals. In this 
regard, it is similar to the voter described in section 
D. 



F . Functional Redundancy 
1 . Introduction 

This section deals with a reliability problem 
that is somewhat different from that of a voting element. 
Here the major concern is the improvement of the overall 
reliability of the entire system by partitioning the 
system into functional blocks and making each block 
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INPUTS 


OUTPUT 


V 1 


V 2 


V 3 


V out 


0 


0 


0.1 


0.033 


0 


0 


0.5 


0.180 


0 


0 


0.8 


0.210 


0 


0 


1.0 


0.200 


0 


0 


1.2 


0.174 


0 


0 


1.5 


0.114 


0 


0 


2.0 


0.060 


0 


0 


3.0 


0.018 


1.0 


1.0 


1.0 


1.000 


1.0 


1.0 


1.1 


1.033 


1.0 


1.0 


1.2 


1.066 


1.0 


1.0 


1.5 


1.180 


1.0 


1.0 


2.0 


1.200 


1.0 


1.0 


3.0 


1.067 


1.0 


1.0 


4.0 


1.018 



Table 4.1 Voter Output for Triply Redundant Signals 
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parallel-redundant . 

2 . Principles of Operations 

The usual method for improving the reliability 
of a system is to establish a parallel configuration of. 
two identical units, either both operational or one 
operational and the other in standby. The disadvantage 
of this arrangement is that the failure of any one 
component within the unit would place that entire unit 
out of action. 

If the system is partitioned into functional blocks, 

and each block is parallel redundant, this would 

significantly increase system reliability because now 

even if one block in a set fails, the other blocks in 

( 49 ) 

the set can still be used. The outputs of each 

functional block are cross-strapped to the inputs of 
the succeeding pair. A block diagram of such system 
is shown in Fig. 4.13. The system may be an encoder, 
decoder, or any other functional device in a control 
scheme . 

With the system partitioned into five parallel- 
redundant functional blocks, it can now be configured 

5 

into 2 , or 32 possible combinations of functions to 
circumvent failures should they occur. Functional 
sections are activated by power switching. With 32 
possible configurations, there is little doubt that 
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Stage A Stage B Stage C Stage D Stage E 



= Failure Hate 

Fig. 4.13 Functional Redundancy 

the overall reliability of the system has been greatly 
improved. 

G. Noise Reduction 

1 . Introduction 

Signals from various instruments are usually 
superimposed with noise. The extraneous noise may be 
a result of thermal emf from an RTD ; or it may be caused 
by self-heating in a thermistor, to name only two of the 
many sources. Chapter 2 contains a detailed description 
of many of the sources that can generate noise in an 
instrumentation system. 

2 . Noise Reduction Methodologies 

Noise can be categorized into two groups: 
random or coherent. Random noise is usually generated 
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within components, such as RTDs, transformer cores, or 
semiconductor junctions, whereas coherent noise is either 
locally-generated by processes, such as voter switching, 
or coupled in. Coherent noise often takes the form of 
"spikes" . 

Regardless of the noise origins, several methods 

are commonly used to retrieve the original waveforms. 

Some of these noise reduction techniques are analog-to- 

digital conversion, shielding and guarding, signal 

compression and filtering, and where possible, an 

information rate that has enough redundancy to allow 

the digital processor to retrieve data via correlation 
( 9 ) 

and summation. 

Where noise is likely to have large spikes as a 
major component, the integrating-type A/D converter 
(dual-slope) usually provides additional filtering. 

For random noise, if there are sufficient samples taken 
of a given signal channel, the technique of averaging 
may be used as a filtering device. 

3 . Technique of Averaging 

Averaging is a noise reduction technique 
often used in a digital system. A digital averager is 
basically a device used for averaging repetitive noisy 
signals. Signal averaging has the ability to recover 
the signal's original waveshape from the noise. In 



this way, the signal-to-noise ratio can be improved 
by several orders of magnitude. 

The author would like to point out that the averager 
mentioned here is different from the averaging 
multiplexing technique examined in section C. In 
section C the averager is a device that takes an average 
value of the signals from three redundant channels. 

Here, averaging is a technique that reconstructs a 
signal waveform by taking the average of a sufficient 
number of repetitive noisy signals. In this regard, 
the averager described in section C, in addition to 
improve the reliability of the signal, also acts as 
a noise reduction device. Of course, the degree of 
noise reduction is not as extensive as compared to the 
averager in this section since only three samples are 
taken (in a triply redundant case). 

Provided the waveform is repeated over and over 
again, any signal waveform which is corrupted by noise 
can be reconstructed. For a weak periodic signal that 
is buried in noise, the technique enhances it by over- 
laying successive segments of the noisy signal, where 
the segment length equals the period of the signal. ^0) 

Even when the waveform repeats itself at irregular 
intervals, but if some characteristics of the signal can 
be used to align the successive, noisy waveforms, aver- 
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aging can still be used. Fig. 4.14a and Fig. 4.14b 
illustrate such an example. The signal in Fig. 4.14a 
has a rather poor signal to noise ratio, but it contains 
a sharp peak which rises above the noise. By aligning 
the peaks and then averaging the noisy waveforms together, 
the noise will tend to cancel itself out whereas the 
signal reinforces itself; the result is shown in Fig. 
4.14b. 



The averager uses each new noisy signal to update 
a partial average formed from previous waveforms, thus 
forming a new partial average. The sequence of events 
can be seen in Fig. 4.15. The symbols in Fig. 4.15 



Averaging An Aperiodic Waveform 




Fig. 4.14 a 



Fig. 4.14 b 



are defined as follow: 



e 



is the present noisy waveform to be averaged 



E is a sampled and quantized version of e 



A is a sampled and quantized version of the 



present partial average before it is modified 
by E. 
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Averaging System Waveforms 



Time 





A 




Fig. 4.15 
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4 . Low-pass Filter for the Vote-taker 

It was shown in the discussion in section D 
that the output of a voter is rather jagged; the 
switching action of the voting circuitry is the cause 
for this high frequency spectra.l content. 

Fig. 4.16a represents a digital input with a broad 

(?) 

band noise spectrum. Note that the abscissa is in 

a log scale. Three input signals with similar noise 
spectrum like that shown in Fig. 4.16a are fed into a 
voting multiplexer. The output after multiplexing 
(Fig. 4.16b) shows some fairly interesting effects. 

The overall waveform is considerably smoother. At 
high frequencies, however, substantial harmonic contents 
are still present. 

In Fig. 4.17a a digital input signal with a narrow 
band noise spectrum is shown. The output after a voter 
is illustrated in Fig. 4.17b. Here, one can see clearly 
that there are definite peaks at integer multiples of 
the fundamental frequency. 

In a practical situation the signal spectrum and 
the noise spectrum often overlap, therefore, considerable 
noise can be filtered out by using a simple low-pass 
RC filter like that shown in Fig. 4.18. 

5 . Buffering of Data 



In the digital mode, one can conveniently 
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Fig. 4.17 a 



Fig. 4.17 b 



+ 



V; 



O 




■o + 



V 0 



Fig. 4.18 RC Filter 
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manipulate the time variable under various circumstances. 
After an analog signal has been converted to its digital 
form, time is no more constrained than any other char- 
acteristic of the signal. In fact, time can be compressed 
This process permits the collection of data at a slow 
rate and the output of this collected data in a fast burst 
For example, when temperature signals are picked up by 
an RTD over an interval of a few seconds, they can be 

compressed and repeatedly processed or displaced every 

_ . , , . , ( 50 ) 

few milliseconds. 

If certain Gaussian noise is always present in a 
particular frequency band, while the signal itself 
spreads out in the entire frequency spectrum, then one 
may wish to use a band-pass filter for noise reduction. 

In digital telemetry, in addition to increase trans- 
mission efficiency, data compression is often used as 
a technique to reduce noise. By using data compression, 
the amount of data to be transmitted is now reduced, 
usually in the form of redundancy reduction, variable- 
length encoding, or parameter extraction. If the 
remaining important data are reorganized at constant 
time intervals, a bandwidth compression is also 

f rr i 5 2) 

achieved. ’ ' Thus, the technique of data compression 

is now also acting as a band-pass filter. 
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6 . Software Digital Filters 

Software digital filters refer to the different 
algorithms that one can use to implement a filtering 
operation on a general purpose digital computer. Some 
of the better known procedures include the Fourier 
Transform, the Walsh Functions, and the Wiener filtering 
technique. The Walsh Functions are particularly useful 
for non-linear ' signals . Reference (53) provides more 
details in this area. 

/ 

H . A Simple Example in Multiplexing 

In Fig. 4.19 the author has designed a simple 

triply redundant multiplexing system to illustrate many of 

the topics already discussed in the preceding sections of 
(50 54) 

chapter 4. ’ The design is intended to be general 

enough so that its methodologies can be applied to most 
engineering systems. 

The signal levels out of many transducers are usually 
in the millivolt range, possibly 10 or 100 mV full scale. 

In addition, the transducers are often located in a noisy 
environment. In Fig. 4.19 it is assumed that the trans- 
ducer output is about 10 mV and that its two output leads 
are electrically isolated from ground. The cable leading 
from the transducer, however, is subject to capacitive 
and inductive noise pickup. 

3y using shielded cable, most noise pickup can be 
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Fig. 4.19 A Simple Example in Multiplexing 
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minimized; however, common-mode noise may still exceed the 
transducer output by several orders of magnitude. Common- 
mode noise is that component of the total noise picked up 
which is common to e^ and e^. It is the major role of the 
instrumentation amplifier to provide common-mode-noise 
rejection. Moreover, the amplifier amplifies the signal 
e^ - e^, and provides a high input impedance and a low 
output impedance. 

The low-pass filter just upstream of the parallel A/D 
converter is used simply to filter out any high frequency 
spectral contents in the original transducer signal. 
Sometimes, no filtering is needed because of the low-pass 
characteristics of the signal and noise or the input cable. 

The parallel 16-bit A/D converter used here has already 
been discussed at the end of chapter 1. The most evident 
advantage of parallel conversion is its tremendous speed. 

The information no longer has to be converted bit by bit 
because as the input changes, the output code also changes. 
With a parallel A/D converter, a sample and hold circuit 
is no longer needed. 

As mentioned in chapter 1, A/D conversion is performed 
near the signal source, and each instrumentation package 
is powered from a separate power source. After the signals 
have been converted from analog to digital, they are then 
transmitted to the control center for multiplexing. 
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Here, the three redundant signals are processed by the 
vote-taker; the output will simply be the median value of 
the three input signals. The switching action of the voting 
element will inevitably produce considerable spikes on its 
output, so a low-pass filter is needed here. 

Before the signal is sent on its last leg to the digital 
meter for display, it is processed through an averager 
(already examined in detail in section G) for further noise 
reduction. The digital signal can also be sent to a D/A 
converter so that the analog output can be used in an 
analog control scheme, like the positioning of a valve based 
on flow signals. 

The author hopes that with the above example, the 
reader has acquired a better understanding of the various 
functions of a control system that uses redundant instru- 
mentation, and more importantly, how all of the components 
perform together to enhance the reliability of any noisy 
signal . 

In chapter 5 a case study of some of the control systems 
at the Deer Island Sewage Treatment Plant will be presented. 
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CHAPTER V 

DEER ISLAND SEWAGE TREATMENT PLANT - 
A REVISITED CASE STUDY 



A. Introduction 

The Deer Island Sewage Treatment Plant in Boston, 
Massachusetts presents a very unique case study in control 
systems engineering. In order to control pump speed at the 
Deer Island plant, flow and level signals from the three 
headv/orks must be transmitted to the pumping station at 
Deer Island. These telemetered variables must be extremely 
reliable to prevent any massive overflows or even flooding 
at the pumping station. The control system at Deer Island 
employs an unique method to assure transmission reliability 
by checking for any differences between the transmitted 
and returned signals. Here, "returned signal" refers to 
a signal that has reached its destination, but has now 
returned to its source. The reader will be introduced to 
this clever control scheme in the following pages. 

B. System Description 

The Deer Island Sewage Treatment Plant is the larger 
of the two sewage treatment plants within the Metropolitan 
Sewerage District (MSD) in the Boston Harbor-Eastern 
Massachusetts Metropolitan Area. The Metropolitan Sewerage 
District comprises of 43 cities and towns, and 225-mile 
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network of interceptor sewers leading to processing facilities 

ncl 

at the Deer Island and Nut Island (the 2— plant) sewage 

( 55 ) 

treatment plants. Here, primary treatment is given to 

a combined average daily flow of 450 million gallons and a 
maximum daily flow of 1.2 billion gallons at these two 
plants. Wastewater from almost two million people and 
stormwater runoff from rainfall are processed to remove 
suspended solid matter and chlorinated to destruct bacteria, 
prior to discharge into Outer Boston Harbor. 

The next paragraph briefly describes the basic functions 
of the pumping station at Deer Island. 

A major portion of the flow from communities in the 
Boston metropolitan area located near the Mystic and Charles 
rivers empties into deep rock tunnels under Boston Harbor 
which carry it to the Deer Island Treatment Plant. The 
pumping station at Deer Island is required to lift flows 
from the deep rock tunnels, which are some 300 feet under 
Boston Harbor, into the treatment plant. The pumping 
station has a capacity of 810 million gallons per day. 

Professor Henry M. Paynter of M.I.T. has long been 
closely associated with the pumping station and its control 
systems at the Deer Island plant. In January 1982, the 
author visited the Deer Island plant and the Chelsea Creek 
Headworks for the first time. The visit was made possible 
only with the most congenial cooperation from Messrs. 
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Ken Donavon and Paul Sullivan of the Deer Island plant and 

with Professor Paynter as a most knowledgeable guide. Fig. 

5.1 shows a diagram of the entire Deer Island plant and 

(55) 

basically how it works. 

One must be selective in making a case study of a 
complex system like the Deer Island plant; therefore, the 
author intends to cover only some of the control systems 
which are relevant to this thesis. In particular, the 
areas that will be covered are the followings: 

1. Sewage Tunnel System 

2. Central Control Panel 

3. Digital telemetry vs. aging analog system 

4. Instrumentation for electric-driven pumps 

5. Instrumentation for future electrical generators 

C . Sewage Tunnel System 

The Metropolitan Sewerage District tunnel system 
is shown in a simplified schematic form in Fig. 5.2a. 

Here the dash components denote the flow and level-control 
action. The block diagram in Fig. 5.2b can be used to 
investigate hydraulic transients in such sewage-disposal 
system, as Paynter was called upon to perform at one time. 
The physical elements are interconnected as shown in Fig. 
5.2C. (56 > 57 > 

If a control scheme is designed so that the downstream 
flow Qc simply follows the inflow Qa, rather violent surges 
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TELEMETERED CONTROL 




Fig. 5.2 a Sewage Tunnel System 



I 1 




Fig. 5.2 b Computer Block Diagram 
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TELEMETERED 



INFLOW (Qa) 



/•K ^t\ 




CAPACITANCE (A^ 



INERTIA (I b ) 



RESISTANCE (K fe ) 
r~ CAPACITANCE (A g ) 



CONTROLLED PUMPS 



(B 1 , B 2 , T) 



Fig. 5.2c 



will occur whenever the flow is disturbed. Such heavy 
transients cannot be tolerated; thus the pumps at the Deer 
Island plant are placed under control of the following 
telemetered variables: 



(a) 


Input flow 


Qa 


(b) 


Upstream level 


(c) 


Downstream 


level 


(d) 


Output flow 


Qc 



Using the above variables, the pumps are constrained 
by the following relations: 



d Q, 



dt 



Qc = Qa + Q. 



+ Q t = B 1 H x + B 2 T 



d H, 



dt 



where B^ , , and T are controller adjustments, 
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An ASME publication entitled "The Dynamics and Control 

( 58 ) 

of Eulerian Turbomachines" v ' by Paynter provides an in- 
depth study of the actual control scheme for individual 
pumping units (inner loop of Fig. 5.2c). 

As one can see, the reliability of the four telemetered 
variables is vital to the operations of the pumping station. 
In the next section, the reader will be introduced to a 
sophisticated control panel (even in today's perspective) 
that monitors the reliability of the flow and level signals. 

D. Central Control Panel 

As mentioned in section C, flow and level signals 
are continuously used as part of a control scheme to 
regulate the speed of the pumps. A highly visible control 
panel that shows the quality of each flow and level signal 
is located in the main pumping station control room. From 
Fig. 5.1, it is clear that the Deer Island plant receives 
pretreated sewage from the three headworks, namely Ward 
Street, Columbus Park, and Chelsea Creek. Accordingly, 
flow and level readings from the three headworks must be 
closely monitored* 

Since the six telemetered control variables must be 
transmitted from the headworks to the Deer Island plant, 
transmission reliability cannot be overemphasized. The 
Deer Island plant uses an elaborate control scheme to 
monitor the reliability of the transmitted signals. Fig. 5.3 
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( 59 ) 

shows the operations of such monitoring system. 

At one of the headworks analog signal from the flow 
instrument (Parshall flume) or level indicator (bubbler 
tube) is first converted into an air signal, ranging from 
3 to 15 lb. pressure. The air signal is in turn used to 
modulate a carrier frequency; this process is performed 
in the block labeled modulator. The modulated wave is 
then sent to the multiplexer for multiplexing before 
transmitted to the Deer Island plant. Here, the term 
"multiplexing" refers to the simultaneous transmission of 
several messages at different frequency bands over a 
common line. The signals from the headworks to the Deer 
Island plant are transmitted simultaneously on microwave 
and leased line. 

At the receiving end at Deer Island, the received 
signal is first recovered by using band-pass filters in 
the de-multiplexer; the signal is then demodulated to 
retrieve the original signal. This analog signal is in 
turn converted to an air signal to be used as part of the 
pneumatic pump speed control system. 

The air signal mentioned above, in addition to being 
used to regulate pump speeds, is sent back to another 
set of modulator and multiplexer so .that the signal can 
now be transmitted back to the headworks for comparison. 

At the headworks, the returned analog signal is 



Deer Island Telemetry System (Currently in use) 
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converted back to an air signal. Here, the air signal that 
has just returned is compared with the original air signal 
for any differences. The differences, if any, are indicated 
by a set of GREEN, AMBER, and RED lights. The differences 
in air signals are next transmitted back to Deer Island so 
that the control panels at both the headworks and the Deer 
Island plant have the same indications on their status boards. 

Fig. 5.4 shows the status board at the Deer Island plant. 
The three lights are defined as follow^ 60 ^ (where tolerances 
are representative values only): 

GREEN < - 1 % 

AMBER < - 5 % 

RED > - 5 % 

If a red light stays on for more than one second, the 
system is designed to automatically switch to the alternate 
mode, either from microwave to leased line, or vice versa. 

A control panel such as the one used at the Deer 
Island plant greatly improves the confidence level of the 
operator. For example, if all lights are green, the operator 
knows that transmission quality is almost f lav/less. Even 
when one light is amber, as was the case during the author's 
visit, there is no need for urgency or immediate action; it 
may be the result of a minor problem, such as a faulty module. 



Color Coded Status Board 
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E. A Need for Newer Design 

As in any aging system, replacement parts often 
present the most insurmountable problem. Analog transmission 
equipment can still be replaced, although their digital 
counterparts usually have much higher availability and at 
considerably lower cost. Pneumatic control devices, on the 
other hand, are almost vanished from the open market. 
Replacement parts are extremely difficult to be found. It 
would be economically infeasible to have each replacement 
made to its own specifications by a manufacturer. 

A digital system has many desirable features that make 
it a natural choice eventually to replace the analog system. 
The technique of pulse-code modulation is particularly 
attractive, as the reader will see why in the next section. 

F. Digital Telemetry 

1. Pulse-Code Modulation 

In digital communications , a multiplexed 
system often used is the technique of time division- 
multiplex (TDM) in which the signal messages are 
organized in subsequent time intervals, usually by 
sending one sample of each message after the other in 
a cycle or frame and sending one frame after the other. 
If each sample in the TDM system. is represented in 
digital form, a pulse-code modulation (PCM) multiplex 



is obtained 
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The author feels that a digital telemetry system 
using pulse-code modulation deserves careful consider- 
ation as a replacement for the aging analog system. 

Some of the characteristics that are inherent in a 
digital communication system make the PCM system 
considerably more desirable as compared to its analog 
counterpart. In addition, a decreasing cost of 
implementation due to the technological evolution in 
solid state digital integrated circuits makes such 
communi cation system all the more attractive. 

One of the important advantages of a digital system 

is its relative immunity to noise pickup. Any. noise 

picked up in transmission will ride on top of the pulse 

and / or produce grass between the pulses. However, 

as long as a pulse can be distinguished from the noise, 

C 6 1 ) 

there is no problem. ' ' 

Pulse-code modulation uses a binary digital code. 
The peak-to-peak value of the signal to be transmitted 
is divided into a number of discrete steps. The number 
of bits used in the binary code determines the total 
number of steps available and the accuracy of the 
transmitted values. For example, a 16-bit digital word 
provides 2 or 65,536 steps. Clearly, the smaller the 
value each step corresponds to, the higher the accuracy. 
Reference (61) provides a more in-depth explanation on 
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PCM . 

Obviously, a 16-bit word provides considerably 
more accuracy than, for example, a 3-bit word. However, 
the transmission of 16-bit signals require a much 
greater bandwidth. In order to minimize bandwidth while 
maintaining accuracy, several techniques have been 
employed. One method involves the use of adaptive data 
compression, also referred to as "redundancy reduction". 

In this technique, any sampled data which would not add 
significant value to the received information is 
considered redundant and need not be transmitted. As 
a result, the sampling rate is sharply reduced and so 
is the bandwidth. More on this subject in the actual 
implementation of such system. 

2. Implementation 

Fig. 5.5 shows a block diagram of a digital 

telemetry system using digital filtering, data compression, 

and error control coding. The author considers such 

system a viable choice to replace the aging analog 
( 51 ) 

system. As before, flow and level signals will be 

transmitted from the three headworks to the Deer Island 
plant, except now that transmission is via digital 
telemetry with pulse-code modulation. 

Even with the new digital system, there is no 
reason to replace the color coded status light panel. 



New Digital Telemetry System 
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Fig 
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Actually, the status lights are so useful, yet so simple, 
that the people at Deer Island have become quite fond of 
them. Thus, the status board will be incorporated into 
the new digital system, still indicating the differences, 
if any, between the original signal (no longer an air 
signal) and the returned signal. In fact, it is practical 
to simply connect the digital system in parallel with 
the analog system; then, with the flip of a switch, the 
operator can have the control system operate on either 
mode. 

In Fig. 5.5 the three blocks: digital filter, 

data compression, and spectral estimation all perform as 
a team to regulate the bandwidth of the signals being 
transmitted. The digital filter (usually a low-pass 
filter) prefilters the telemetry signals in such a way 
that the following data compressor can operate in the 
most efficient way. As mentioned earlier, data comp- 
ression reduces the amount of data to be transmitted by 
removing all redundant information. If the remaining 
important data are reorganized at constant time 
intervals, the number of sampled points are greatly 
reduced. By this technique, it has been found possible 
to reduce the number of sampled points by at least a 
5 to 1 ratio, and in some cases by as much as 160 to 
1. By reducing the number of samples taken, the pulses 
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per second of modulation are reduced, and the bandwidth 
required is decreased. 

Spectral estimation is a rather useful method to 

perform short-time spectral estimation, and thereby 

adapt the sampling frequency to a more appropriate 
( 51 ) 

value. In general, the sampling frequency is kept 

at the minimum possible value consistent with the 
signal frequency content in order to reduce the amount 
of data sampled. 

When pulse modulation is used, energy is transmitted 
only during the pulse sampling intervals. V/ith data 
compression and spectral estimation, the sampling rate 
is sharply reduced; therefore, the transmitter duty 
cycle is quite low, and the overall transmission 
efficiency is greatly improved. 

Error control coding, a technique that uses the 
coder and decoder, performs a protective measure on 
the transmitted signals. Before the data entering 
the communication channel, suitable control data 
(a given number of bits in an information word) are 
added by the coder. At the receiving terminal, the 
same control data are utilized by the decoder to 
detect (error detection) or correct (error correction) 
the errors introduced by the communication channel or 
other disturbances and interferences. 
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The reader may have noticed that the technique 
of error control coding performs a function that is 
similar to that of the status lights, to assess the 
quality of the transmitted signals. Therefore, if 
the status lights remain as an integral part of the 
new system, coding the transmitted signals may not 
be needed. Of course, one can always use it as an 
extra redundancy. 

G. Insufficient Instrumentation for the Electric-Driven 
Pump 

Currently, there are nine pumps at the Deer Island 
pumping station. Eight pumps are run by diesel engines, 
while the ninth pump is a variable speed electric-driven 
pump powered by on-site generators. With the U.S. diesel 
engine technology in its present state, it is difficult 
to expect the industry to come up with new design to replace 
the aging machines. A few years ago, an electric-driven 
pump was installed so that its performance can be evaluated 
for possible future conversion to all electric pumps. 

If the instrumentation panel for the electric pump is 
intended to be a prototype for future models, it is a very 
disappointing one. There are only two or three instruments 
on the electric pump control panel as compared to almost 
ten instruments on the diesel instrumentation panel. The 
information that one can obtain from the electric pump panel 
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on the overall plant operations is totally insufficient. On 
the other hand, the diesel instrument panel shows a substantial 
amount of plant data. Shaft levels and flow rates from all 
three headworks can be seen clearly in a quick glance. In 
addition, whether a particular unit is pumping from Chelsea 
Creek or Ward St. - Columbus Park is shown in plain view on 
the panel. If an operator, while facing this panel, has to 
make a sudden decision during a plant upset, he has all of 
the necessary plant data to act upon. 

From the above discussion, it becomes clear that adequate 
instrumentation similar to that on the diesel control panel 
must be installed on the electric pump instrumentation panel. 

H. Instrumentation for Future Electrical Generators • 

At the present, the five on-site generators provide 
just enough electrical power for the single electric pump 
and the auxiliaries (sewage treatment, lights, auxiliary 
pumps, etc.). If more electric-driven pumps are used to 
replace the aging diesel engines, considerable more elect- 
rical power must be needed. This in turn will require 
more electrical generators to be installed. One proposal 
involves the installation of several gas turbine generators 
using methane gas as fuel (methane gas is a byproduct from 
the decomposition of sewage sludge). 

Whether one uses gas turbines or diesel engines for 
electrical generation, proper control systems and adequate 
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instrumentation must still be provided. The triply redun- 
dant multiplexing system shown in Fig. 4.19 is a good 
starting point for the design of such control system using 
redundant instrumentation. As in any thermal power plant, 
the parameters monitored will be temperature, pressure, flow, 
and possibly density. 

In chapter 6, some particular aspects of instrumentation 
errors will be examined. Chapter 6 is different from 
chapter 2 in that chapter 2 dealt with instrumentation errors 
and uncertainties in a survey format, whereas chapter 6 will 
discuss some of the methods that one can use to compensate 



for these errors 
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CHAPTER VI 

PHYSICAL CONSTRAINTS IMPOSED BY CONSTITUTIVE 
AND CONSERVATION RELATIONSHIPS: 

IMPLICATION FOR INSTRUMENTATION REDUNDANCY 

A. Introduction 

Sometimes instrumentation readings that obviously 
need to be density or temperature corrected are still being 
used without either correction. And occasionally, instru- 
ment data that clearly violate laws of conservation are 
still being recorded and interpreted as if they were correct. 

The area of physical constraints imposed by constitutive 
and conservation relationships is another promising area 
for redundant instrumentation. However, due to lack of 
time and general unavailability of sufficient literature 
in this area, the author will only attempt to present a 
cursory treatment of this subject matter. A few brief 
examples will be given later in this chapter. 

B. Density Correction 

1. Computation of Density from Pressure and Temperature 
An excellent example to illustrate the fact 
that some instruments need density correction is the 
differential pressure (d/p) cell. The d/p cell is used 
to measure flow rate in either a liquid or gas medium. 

The differential pressure caused by the velocity increase 
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0 



is proportional to the square of the flow rate. More 

specifically, the Bernoulli equation leads to the 

( 62 ) 

following flow rate relationship: v ' 

V (flow rate) = Q = AV = A<t> j 2 ^ ^ (6.1) 




T, 

P t 



V 



p . 



Fig. 6.1 Differential Pressure Cell 

From equation 6.1, the following mass flow rate (M) 
expression can also be established: 

( 6 . 2 ) 

H = P Q ~ f~P Z A p' (6.3) 

'mean v ^ mean 

Clearly, P 1 and P 2 can be measured experimentally, 
as indicated by the pressure taps in Fig. 6.1. If 
fluid properties are also known, one would only need 
temperature to compute density. With A P, p , and 
A (physical dimensions of orifice plate) , the actual 
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mass flow rate can be easily calculated. Since is 
usually not equal to T^, thus temperature measurement 
here refers to an average value of and T 2 » More 
on temperature correction in section C. 

2. Actual Measurement of Density 

Since T 2 is normally not equal to T^, will 
be different from /O . Therefore, both p ^ and /O 2 
must be measured to obtain a more correct value for 
density. Again, here a more correct value could simply 
be the mean value of p ^ and /° 2 * As for density 
measuring device, one can use the vibration type liquid 
densitometer described in chapter 2 to measure the two 
density values. 

C . Temperature Correction 

As mentioned in the last section, T 1 and T 2 of 
Fig. 6.1 do not normally share the same value. The following 
paragraphs will briefly explain this phenomenon. 

As the fluid passes through the orifice plate, some of 
the kinetic energy (no matter how infinitesimal) will be 
lost due to impingement of the liquid on the plate. This 
loss in kinetic energy is usually recovered in the form of 
heat, or a slight increase in temperature on the orifice 
plate and in the fluid. Therefore T 2 will no longer be 
the same as T^. 

Since some of the total energy is lost at the orifice 
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plate, the total energy at point 1 (H 1 ) must be greater than 
the total energy at point 2 (H 2 ), or A H = H^ - H 2 > 0. 

Since one can assume with reasonable accuracy that |ah| 
is proportional to the change in internal energy, |au| , 
it can be concluded that T 2 - > 0. In sum, the situation 

in Fig* 6.1 can be expressed as follows:'' ' 

If AH = H x - H 2 > 0 

and | A H | ~ |au| 
then T 2 - T 1 > 0 . 

As one can see, in order to get a more representative 
value for temperature, both and T 2 must be measured. 

D. How to Minimize Data Error in a 2-Phase Region 

P , P , T and T t are measure«d values 

V 1j V Li 



Vapor 



Liquid 




Interface 

Region 



Fig. 6.2 2-Phase Region 
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In a 2-phase region like that shown in Fig. 6.2, 
it is often difficult to determine true temperature and 
pressure. The two procedures described in the following 
paragraphs should prove to be quite valuable in minimizing 
data error. v 1 The reader should be aware of the fact 
that the two correlation procedures will not produce 
identical results. One method will normally produce a more 
accurate result than the other, as the author will illustrate 
with a simple example. 

Procedure 1 

a. Determine T . (P ) and T . (P T ) 

sat v sat L 

b. With the four data points: T (P ) , T (P_ ) , T 

S V S Li V 

and T l , minimize error by the following methodology: 

4 o 

let E( error) = £ (W k T k - T; 

k*l 

where W k are weight factors based on confidence 

level of each measurement, 

then E = £ (W k 2 T R 2 - 2 \J T k T + T 2 ) 

= H W k 2 T k 2 " 2 T Z W k \ + 4 T 2 

Minimizing E yields: ' — = 0 = -2 S W, T, + 8 T 

dT K K 

T _ S w k T k 

4 



c. Since this is a saturated state, if is knovm, 



sat 



can be determined. 
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Procedure 2 



a. Determine P sat (T y ) and P sat (T L ) 

b. With P (T ), P (T t ), P and P_ , repeat part b 

S V S V 

of procedure 1 to find P ^ • 

c. If is known, T ^ can be easily found. 



E . An Example in Minimization of Data Error 

For this example, the 2-phase medium is assumed to 
be saturated vapor and liquid at 400. 0°F and 247.26 psi. 

In the vapor region, due to the insulation effect of a steam 
blanket, pressure can normally be measured with greater 
accuracy than temperature; therefore, the following contamin 
ated values of pressure and temperature and their weight 
factors (W's) are assumed: 



P v = 248.00 psi 


T v = 396 . 50°F 


P L = 246.20 psi 


T l = 401 . 50°F 


W (P y ) = 0.5 


W (T v ) = 0.1 


W (P ) = 0.2 


W (T l ) = 0.2 



In order to determine temperature values given pressure 
measurements, or vice versa (as required by procedures 1 & 2), 
the method of interpolation is often used if one needs to 
determine values that lie between tabulated data in a steam 
table. However, the results obtained from such method are 
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rarely reproducible. With the advent of digital computer, 
the technique of analytical curve fitting becomes practical. 
Moreover, the results are always reproducible. 

One can use the following procedure to fit the saturation 
curve analytically. In this procedure an algebraic expression 
is determined by performing linear regression on several data 
points from the saturation curve. Once determined, this 
algebraic relationship can be used to generate pressure values 
based on temperature inputs, or vice versa. 

If a transformation is performed on the two parameters, 
pressure (P) and temperature (T), two new variables can now 
be defined as follow: 

X = — — where T is absolute (6.4) 

T 

Y = In P (6.5) 

With the two new variables, one can easily use the 

following linear laws for curve fitting the saturation line : 

X = a - b Y (6.6) 

Y - c - d X (6.7) 

where a, b, c and d are constants that will be 
determined. 

The reader should be aware of the fact that if only 
two data points are used to fit the saturation curve, 
identical curves will result by either correlation method 
(Y vs. X or X vs. Y). 
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Using five data points from the saturation curve and the 
technique of linear regression on each of the two equations 
(6.6 & 6.7), the following values for constants a, b, c and 
d were determined: 

a = 3.27 x 10“ 3 
b = 2.14 x 10" 4 
c = 15.30 
d = 4,676.17 

Thus equation 6.6 and 6.7 can now be rewritten as follow: 

— = 3.27 x 10~ 3 - (2.14 x 10" 4 ) In P (6.8) 

T 

In P = 15.30 4 - ? - — --1 — ■ (6.9) 

T 

With equations 6.8 and 6.9, one can proceed to procedures 
1 and 2 in this example. 

Procedure 1 

a. Using equation 6.8, the following temperature values 
are found: 

T . (P ) = T (248.00 psi) = 400.27°F 
Set w V s 

T sat = T s ( 246 * 20 P si ) = 399.63°F 

*>• T sat = where T k - T s <V- T s 

T and T t 

V Jlj 

Using the weight factors assumed earlier, 

T sat 1:560011163 400.01°F. 
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c. With T gat = 400. OiF, using equation 6.9, 
P sat " 247 • 27 psl ‘ 



Procedure 2 



a. Using equation 6.9, the following pressure values are 
determined: 

P sat (T V ) = P s ( 396 * 50 ° F ) = 237.55 psi 
P sat (T L^ = P s ( 401 « 50 ° F ) = 251.50 psi 



b. Psat = 



p k 



Where P. = P (T ) , F (T t ) 
k s v * s L 



P and P r 
v L 



Using the weight factors assumed earlier, P sat 
becomes 247.29 psi. 

c. With P £ = 247.29 psi, using equation 6.8, 

T sat * 400 - 02 ° F 

As the reader might have observed, the temperature and 
pressure values deduced from both correlation procedures are 
almost identical to the true values. ' However, one should 
be aware that such closeness between these two sets of values 
has been partially due to a coincidence in correlation between 
the contaminated values and their respective weight factors. 



F. Redundant Parameters - T, P, /O 

In this section, the technique of using redundant 

( 63 ) 

parameters to minimize data error will be discussed. v ' 
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As the reader knows, any one of the three parameters, T, P, 
and /O can be considered as redundant, and any two of the 
three parameters can be used to compute the value of the 
third redundant parameter. Furthermore, the computed value 
can then be used to check on the accuracy of the actual 
measurement. This procedure is illustrated as follows: 




Range of 
Measurements 



measured 

values 



computed 

values 



(The range of measurements is based on readings from 
three redundant instruments) . 



A general procedure to minimize measurement errors is 
described as follows: 

1. Measure T , P , and Q experimentally 

m m ' m 

2. Compute T , P , and p and use these as the adopted 

CO c 

values for T adopted , P adopted , and p adopted 

3. Formulate the following least squares error expression 
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Let E (error) = W (P - P ) 2 + 17^ (T - T ) 2 

p ' m a T m a 

+ V/p ( P - R ( T , P ) ) 2 
^ ^ m r a a’ a 



where W 



where W , V/^, and t/p are weight factors based 
on standard deviations of instrument readings 



4. Minimize error by the following equations: 






However, the expressions found for P , T , and p 

Q. Si ' cl 

must be subject to the constraint of the state 
equation, <p (P & , T & , /O & ) = 0 

5. Must distribute corrections so as to reduce errors 
based on constraint. 

G. The Role of Conservation Laws in Measurements 



such as mass conservation, momentum conservation, and energy 
conservation can never be violated. However, instrument 
readings that clearly violate these laws are often still 
being recorded. 

The following three brief examples exemplify some typical 
situations in which the instrument readings might be left 
in error if the specific relationships are violated: 

1. Conservation of Mass 



All engineers know that the laws of conservation 



M - 2 F1 °"'in - E Flov W 



( 6 . 10 ) 
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Fa 



TZ7 






F b 



II 
) ( 




T 

£F = 


time-averaged 
measurement of 
f lov; 


1 1 

1 1 
1 1 
1 1 


/^\ 


Fout 





Fig. 6.3 Flow Measurement 

In Figure 6.3 the sum of F and F, at any time t 

a o 

is not necessary equal to F ^ . However, if one takes 
the time-averaged measurements of the three flows, 
within the accuracy of the instruments, the following 
relationship should always hold: 

T T T 

EF a + EF b = KF out (6. IX) 

If the above relationship is violated, then the 
errors must be distributed accordingly among the three 
flowmeters. Reference (64) provides an in-depth study 
of many of the commonly found flowmeters. 

2. Conservation of Momentum 

G = £ Force in - £ Force Qut (6.12) 

For any flow in the direction indicated as shown 
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Fig. 6.4 Pressure Measurement 

in Fig. 6.4, must be greater than P^ . If the 
pressure sensors indicate differently, one or both 
instruments must be in error and need to be adjusted. 



Saturated Steam 



Hot 

Water 




Cold 

Water 



Fig. 6.5 A Simple Heat-Exchanger 
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3. Laws of Thermodynamics 

Example 3 as illustrated in Fig. 6.5 is a much more 
complex case. Careful energy and heat balance calculat- 
ions must be performed before any violation of thermo- 
dynamic laws can be shown. 

By the first law of thermodynamics, the following 
expression is true: 

^steam ^steam ” ^cond^ ~ m water ^HW ~ h CVp (6.13) 

Clearly, specific data such as mass flow rates 
(m's) and enthalpies (h's) are needed for the energy 
balance calculations before any given instrument can be 
isolated as faulty. 

In addition, if one considers the second law of 
thermodynamics, then the following relationship in 
terms of entropy (s) is always true: 





Us. 

out 


> S in 




(6.14) 


steam 


S cond + 


^water 


S HW > 


m steam 


s steam + 


i , 

water 


S CW 








(6.15) 



One must realize that although the heat exchange 
between the system and surroundings can be assumed to 
be zero, an increase in entropy is to be expected, 
because the process is basically irreversible. 



It should be clear to the reader that concern for 
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the physical constraints imposed by laws of nature is 
indeed an important aspect of redundant instrumentation 
Only occasionally are attempts made by engineers to 
distribute instrument errors consistently within a real 
time system. Much more work remains to be explored 



in this area 
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APPENDIX I 

VARIOUS TEMPERATURE AND PRESSURE SENSORS 

A. Platinum RTDs 

Platinum, being a noble metal, is used almost 
exclusively for precision resistance thermometers. Platinum 
resists corrosion and chemical attack under most environments 
so it is fairly stable. In addition, it is easily workable 
and can be drawn into fine wires. Moreover, platinum has 
a high melting point (1772°C) and in fact, shows little 
volatilization below 1000°C. All this is evidenced by a 
linear and stable resistance-temperature (R - T) relation- 
ship that characterizes the platinum sensor over a wide 
range of temperatures. An early example of a platinum 
RTD from the National Bureau of Standards is shown in Fig. 1. 

B. Carbon Resistance Thermometry 

1 . Advantages and Disadvantages 

The carbon resistance thermometer has a number 
of desirable qualities as a secondary thermometer, 
including high thermometric sensitivity, small physical 
size, fast response, ease of installation, and very 
low cost. The major drawback, however, is that there 
is no well-defined theoretical (or empirical) resistance 
temperature relation for use in extrapolation or 
interpolation. As a result, a somewhat laborious 



151 



calibration procedure is usually required throughout 
the temperature range of interest. 




Fig. 1 Construction detail of a platinum 
resistance thermometer tip 



2. Effects of Magnetic Field 

Experimental data showed that the magnetic 
field effect is strongly dependent on temperature and 
becomes substantially larger as the temperature is 
reduced. It is interesting to note that the effect is 
independent of whether the magnetic field is applied 
parallel or perpendicular to the resistor axis. 

In a time varying magnetic field, the effect may 
be considerably more severe. Eddy currents may be 
introduced in the leads which, by Joule heating, warm 
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the thermometer above the temperature of the surround- 
ings. This is especially true if the leads have a 
solder coating. The solder alloy may become super- 
conducting, but with a transition spread over a wide 
temperature range. Therefore, the resistance of the 
solder coating can be quite small over a considerable 
range of the magnetic field and may result in a large 
dissipation of power. 

C . Germanium Resistance Thermometry 

Besides carbon thermometry, a second major category 
of semiconductor resistance thermometry is the germanium 
resistance thermometer. The germanium thermometers share 
some of the inherent problems with the carbon thermometers, 
such as self-heating errors, but it does have its own 
unique characteristics. 

Germanium, in its intrinsic form, is a rather poor 
resistance measuring device in the cryogenic region because 
its dR/dT is so large, and its resistance at a temperature 
approaching absolute zero (0 Kelvin) is so great. However, 
solid state physicists have utilized the idea of mixing two 
or more elements to form an alloy which would reduce both 
the near zero Kelvin resistance and the sensitivity to 
dR/dT. Impurities are commonly introduced into germanium in 
the form of pure elements. Some -of these elements include 
phosphorus, gallium, and arsenic. 
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D. Noble Iletal Thermocouples 

1 . Environmental Stability 

/ 0 0 \ 

Darling and Selman' ' conducted a series of 
experiments in which the environmental stability of 
noble metal thermocouples was investigated in a system- 
atic manner. In particular, they studied the compati- 
bility of the platinum metals with oxides such as 
alumina, magnesia, zirconia, and silica. Their experi- 
mental results indicated that the reactions betv/een 
platinum and the refractory oxides are controlled by 
the affinity of platinum for the metal released on 
decomposition, by the surface area of the reacting 
substances, and by the rate at which oxygen and metal 
vapors can be removed from the reaction zone. 

2. Chemical Reaction 

Metal oxide decomposition involves a process 
of dissociation which yields both metal and oxygen in 
gaseous form. In the case of aluminium, the reaction 
can be described as follows: 

2/3 Al 2 0 3 ► 4/3 A1 + 0 2 

Alumina dissociates, oxygen is evolved, and platinum 
extracts metal from the refractory to form dilute 
alloys. Experimental data confirmed that platinum has 
a much higher affinity for zirconia and alumina than 
for magnesia. One proposed postulate to explain this 
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phenomenon is that the magnesium-magnesia dissociation 
pressure is higher than the vapor pressure of platinum, 
whereas the metallic vapor pressures of zirconium and 
aluminum lie well below that of platinum. Most of the 
reaction processes occur through a vapor phase and 
proceed rapidly only when oxygen is continuously removed 
from the reaction zone. 

E . Variable Resistance Pressure Transducers 

A diagram that illustrates the basic operating 
principle of the variable resistance pressure transducer 
is shown in Fig. 2. The pressure to be measured is applied 
to the force collector (capsule) which, through a linkage 
rod, moves a sliding contact (wiper) across the electrical 




Fig. 2 Potentiometric Pressure Transducer Schematic 
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resistance wire windings. This action in turn produces a 
resistance change between the wiper signal lead and an 
excitation lead. Therefore, with the wire excited as shown, 
a voltage change between the wiper and excitation lead can 
be developed. This change is linear for most transducer 
designs. A nominal full-scale deflection for such a system 
is about two percent of the capsule diameter. In order to 
obtain large deflections, two or more capsules may be 
cascaded so as to add the deflections of each. 

Besides using a capsule, a bourdon tube can also be 
used as a force collector. The bourdon tube is a spring 
alloy tube with an elliptical cross section which is closed 
at one end and is shaped in a curved or twisted configuration. 
When pressure is admitted into the tube, the difference in 
area exposed to the pressure causes the curved tube to tend 
to straighten. Thus, if the open end is held securely, the 
closed end will move. The bourdon tubes can generally 
provide greater deflections than capsules. Many transducer 
designs incorporate the spiral, helical, and C-shaped 
bourdon tubes because of their large deflections which in 
some cases permit transducers to be built without an extra 
linkage between the tube and the resistance element. This 
minimizes vibration, friction, and backlash problems. 

The resistance element of a potentiometric transducer 
most frequently consists of electrical wire wound on a 
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mandrel. The wire is generally a platinum alloy on the order 
of 0.001 - in diameter, whereas the mandrel is an insulating 
material such as ceramic or phenolic . 

F. Strain-Gage Pressure Transducers 

Most strain-gage pressure transducers have a 
configuration like that shown in Fig. 3. This is the so- 
called bonded strain-gage technique that consists of four 
active strain-gage elements bonded to the elastic element 
(cantilever). When a force is applied as shown, the two 
top strain gages (1 and 2) are in tension and increase in 




Fig. 3 Bonded Strain-Gage 

Cantilever Transducer 

resistance while the bottom elements (3 and 4) are in 
compression and decrease in resistance. By connecting the 
two elements whose resistance increases (1 and 2) and the 
two whose resistance decreases (3 and 4) in diagonally 
opposite arms of a bridge as shown in Fig. 4, maximum 
output is obtained. 
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Fig. 4 Bqnded Strain-Gage 

Electrical Connection 

In recent years, however, with the advent of semi- 
conductor technology, it has become advantageous to manu- 
facture strain gages from semiconductor materials. The 
semiconductor gages have a gage factor that is approximately 
75 times greater than that of a wire gage. Gage factor is 
defined as the ratio of normalized resistance change to 
unit change of strain. With a substantially higher gage 
factor, manufacturers are now able to develop smaller and 
extremely stiff pressure sensors, allowing high frequency 
dynamic measurements to be made more conveniently and more 
accurately. 

Besides the more familiar bonded metal wire strain-gage 
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configuration, there are several other types of strain-gages; 
some of the examples are gaged diaphragm pressure transducers, 
cantilever- type transducers, pressure vessel transducers, and 
unbonded strain-gage pressure transducers. 

G. Diaphragm-Type Variable Reluctance Transducers 

A variable reluctance pressure transducer commonly 
used in the power industry employs a diaphragm as the 
elastic element and is shown in simplified form in Fig. 5. 




Pressure 



Fig. 5 Diaphragm-Type Variable Reluctance 
Pressure Transducer 

A diaphragm of magnetic material, supported between two 
inductance core assemblies, completes a magnetic circuit 
with the cores. The diaphragm deflects when a differential 
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pressure is applied to the pressure ports. This increases 
the air gap in the magnetic flux path of one core while 
decreasing the gap in the other; therefore, the reluctance 
of each flux path is altered. The overall effect is a 
decrease in inductance of one of the wire wound coils and 
an increase in the other. A half-bridge, two-active-arm 
device is formed if the two coils are connected as shown 
in Fig. 6. 




Fig. 6 Electrical Configuration 
for Variable Reluctance 
Pressure Transducer 

H. Piezoelectric Pressure Transducers 

Most piezoelectric elements will reach a Curie 
point when heated. At this Curie point temperature, the 
crystalline structure changes, polarization is lost, and 
hence the piezoelectric effect is destroyed. Quartz has 
a Curie point of approximately 1000°F, whereas this temp- 
erature for some of the ceramic elements is as low as 
250°F. In addition, quartz has a negligible pyroelectric 
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effect which is defined as the changes in output that are 
proportional to the change in temperature experienced by the 
crystal. It is for these two reasons mentioned above that 
the quartz element is particularly more applicable in areas 
of temperature change and high operating temperatures. 

Ceramic elements, on the other hand, have a charge 
density that is generally 10 to 100 times greater than 
that for quartz; as a result, ceramic elements are often 
used in situations where low pressures are measured. 
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